GitHub user ramanathan1504 added a comment to the discussion: CVE-2026-34480
The issue is only in `XmlLayout`. If none of your `appenders` use it, the code
with the flaw never runs, so you're not affected. Your scanner flags it from
the `log4j-cor`e version, though, so upgrading to `2.25.4` is the simplest way
to clear it. If you can't upgrade yet, marking it as not affected (code not
used) is accurate.
Advisory: https://logging.apache.org/security.html#CVE-2026-34480
GitHub link:
https://github.com/apache/logging-log4j2/discussions/4402#discussioncomment-18880949
----
This is an automatically sent email for [email protected].
To unsubscribe, please send an email to: [email protected]
