Your message dated Thu, 15 Oct 2026 22:41:19 +0000
with message-id <[email protected]>
and subject line Bug#1133847: fixed in apache-log4j2 2.26.1-1
has caused the Debian Bug report #1133847,
regarding apache-log4j2: CVE-2026-34480
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1133847: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1133847
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: apache-log4j2
Version: 2.19.0-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for apache-log4j2.
CVE-2026-34480[0]:
| Apache Log4j Core's XmlLayout
| https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout ,
| in versions up to and including 2.25.3, fails to sanitize characters
| forbidden by the XML 1.0 specification
| https://www.w3.org/TR/xml/#charsets producing invalid XML output
| whenever a log message or MDC value contains such characters. The
| impact depends on the StAX implementation in use: * JRE built-in
| StAX: Forbidden characters are silently written to the output,
| producing malformed XML. Conforming parsers must reject such
| documents with a fatal error, which may cause downstream log-
| processing systems to drop the affected records. * Alternative
| StAX implementations (e.g., Woodstox
| https://github.com/FasterXML/woodstox , a transitive dependency of
| the Jackson XML Dataformat module): An exception is thrown during
| the logging call, and the log event is never delivered to its
| intended appender, only to Log4j's internal status logger. Users
| are advised to upgrade to Apache Log4j Core 2.25.4, which corrects
| this issue by sanitizing forbidden characters before XML output.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-34480
https://www.cve.org/CVERecord?id=CVE-2026-34480
[1] https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb
[2] https://logging.apache.org/security.html#CVE-2026-34480
[3] https://github.com/apache/logging-log4j2/pull/4077
[4]
https://github.com/apache/logging-log4j2/commit/4f5014229825d8be977662e0743205bb8a67f989
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: apache-log4j2
Source-Version: 2.26.1-1
Done: Emmanuel Bourg <[email protected]>
We believe that the bug you reported is fixed in the latest version of
apache-log4j2, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Emmanuel Bourg <[email protected]> (supplier of updated apache-log4j2 package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Fri, 16 Oct 2026 00:22:08 +0200
Source: apache-log4j2
Architecture: source
Version: 2.26.1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Java Maintainers
<[email protected]>
Changed-By: Emmanuel Bourg <[email protected]>
Closes: 1109751 1123744 1133846 1133847 1133848 1141960
Changes:
apache-log4j2 (2.26.1-1) unstable; urgency=medium
.
* Team upload.
.
[ tony mancill ]
* New upstream version 2.26.1
Addresses the following CVEs:
- CVE-2025-68161 (Closes: #1123744)
- CVE-2026-34479 (Closes: #1133848)
- CVE-2026-34480 (Closes: #1133847)
- CVE-2026-34481 (Closes: #1133846)
- CVE-2026-49844 (Closes: #1141960)
* Exclude Build-Depends: groovy (Closes: #1109751)
Thank you to Bastian Germann for the patch.
* Add libjspecify to Build-Depends
* Drop MongoDB appender support (log4j-mongodb) until a newer version
of the MongoDB driver (libmongodb-java) is available.
* Update Debian poms for added/removed modules in upstream 2.26.1
* Update debian/rules to set POM revision property to upstream package
version
* Update d/maven.rules and ignoreRules for new upstream release
* Freshen and add patches needed for new upstream release
* Bump Standards-Version to 4.7.4
.
[ Emmanuel Bourg ]
* Removed the Priority field
* Converted debian/watch to the version 5 format
Checksums-Sha1:
4966ab762d538660fe35a4715fd921e217804fcb 2907 apache-log4j2_2.26.1-1.dsc
2b1231ddc0725f19038ceb7c0d1a211eb147e3f3 1551040
apache-log4j2_2.26.1.orig.tar.xz
ef2fb65d208fbc9ded85030d6abe4f111afac92e 10848
apache-log4j2_2.26.1-1.debian.tar.xz
5afb3c6afd9cc5a71ab8d058dc563eec61142668 16031
apache-log4j2_2.26.1-1_source.buildinfo
Checksums-Sha256:
9df9cc67b8abdc1dc76ab729f8655c78cece7ab12a0ecc798e7567019c89339e 2907
apache-log4j2_2.26.1-1.dsc
aa9007f3f03c838d008f43b6e165955a1ef6f258ad0c91366bac2dda74ce29fa 1551040
apache-log4j2_2.26.1.orig.tar.xz
8b2935e05cd5c19372306eabcf02ae96012b168e79c2e9fe38852226c25c5df9 10848
apache-log4j2_2.26.1-1.debian.tar.xz
90c46b6accbc099bc02a8aaaeb2f49ac8e1e66fc1dd8a405c89d188d01581184 16031
apache-log4j2_2.26.1-1_source.buildinfo
Files:
0df3b46099fed287028f50aac4b9f2f2 2907 java optional apache-log4j2_2.26.1-1.dsc
10273152b26afa5a289d6e8f7f17d008 1551040 java optional
apache-log4j2_2.26.1.orig.tar.xz
3df1e64eb457c6151c14fe2dd5943c28 10848 java optional
apache-log4j2_2.26.1-1.debian.tar.xz
a7a09b805636c8a48235851c1c46e193 16031 java optional
apache-log4j2_2.26.1-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmrRUkkSHGVib3VyZ0Bh
cGFjaGUub3JnAAoJEPUTxBnkudCsqZEP/jxWo4B9qsr8rP5osHmv/DWT1nDyEtYs
ZTDpQt78B4opRXMnvqHhfEa39XB1mJSkbgEDBHiBTjrCjZYNiLRXpYd7kvk2gMzV
uSYKGNjTpfyNnZvr1AEzAZi+o0+DpdVGXIrCVIE4l/yjas3zC3tFc8BmCAYr3m1O
ve/V8ZgOOHe3Fa5F7ovWrRaXpC1E+SUz7R0jKQjXy6kU5CSgfQsVPxBQs+Hfv+wp
sz6Vw5ayxUjYlXjc8OI6c/w/FNoIE38KHgpFfVnJxAOmB4lH8aFiahx5BItz6AZD
HS54e3q45uaJzQKZo+XuAwV/xxTerRkQtiDkPhN/yxGYOksG86Fmxb32JN2oW7ip
HZyQJCwMTxO5/Zw2A0F+oxo7d9humN11Ql/2c+Vz1FsYb1UQU34TKKaNzWnq01L7
4mRuRnEDMMf/FfchqxyvxI1z8KeMZJtf4PkOx0Krx3iRZz6Gl2jft2cIkTAEVcmB
O0QWGWPCTuonmybyvBk8BR1wBzOoARFPyxkXnoUjWX5LtdO9WPcXl/BghGbYuLJb
UrR77BU8GGIFwZ/gGHv4hjsBzE5ITCMDxLbdCdsNi2lokQfZM7M+TVW98RFdJfYh
2IwzoyJuGnqW82svZkaiBbGKg45bpbYR0Ygd42rdLXzY8JpIt3+v1w1IPGZOmpzr
UnbiYZ9+od/F
=MCpb
-----END PGP SIGNATURE-----
pgpkwv2qZ2jla.pgp
Description: PGP signature
--- End Message ---
