CVE-2025-54813

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-54813
Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them. This issue affects Apache Log4cxx: before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/apache/logging-log4cxx/pull/512 Issue Tracking Patch
https://logging.apache.org/security.html#CVE-2025-54813 Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:log4cxx:*:*:*:*:*:*:*:*
History

26 Aug 2025, 21:16

Type Values Removed Values Added
First Time Apache
Apache log4cxx
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CPE cpe:2.3:a:apache:log4cxx:*:*:*:*:*:*:*:*
References () https://github.com/apache/logging-log4cxx/pull/512 - () https://github.com/apache/logging-log4cxx/pull/512 - Issue Tracking, Patch
References () https://logging.apache.org/security.html#CVE-2025-54813 - () https://logging.apache.org/security.html#CVE-2025-54813 - Vendor Advisory

25 Aug 2025, 20:24

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de neutralización de salida incorrecta para registros en Apache Log4cxx. Al usar JSONLayout, no todos los bytes del payload se escapan correctamente. Si un mensaje proporcionado por un atacante contiene caracteres no imprimibles, estos se pasarán en el mensaje y se escribirán como parte del mensaje JSON. Esto puede impedir que las aplicaciones que consumen estos registros interpreten correctamente la información que contienen. Este problema afecta a Apache Log4cxx: versiones anteriores a la 1.5.0. Se recomienda actualizar a la versión 1.5.0, que soluciona el problema.

22 Aug 2025, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-22 19:15

Updated : 2025-08-26 21:16

NVD link : CVE-2025-54813

Mitre link : CVE-2025-54813

CVE.ORG link : CVE-2025-54813

JSON object : View

Products Affected

apache

  • log4cxx
CWE
CWE-117

Improper Output Neutralization for Logs