Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-54813

Good to know:

icon

Date: August 22, 2025

Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them. This issue affects Apache Log4cxx: before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue.

Severity Score

Related Resources (5)

https://nvd.nist.gov/vuln/detail/CVE-2025-54813
https://security-tracker.debian.org/tracker/CVE-2025-54813
https://github.com/apache/logging-log4cxx/pull/512
https://logging.apache.org/security.html#CVE-2025-54813
https://www.mend.io/vulnerability-database/CVE-2025-54813

Severity Score

Weakness Type (CWE)

Improper Output Neutralization for Logs

CWE-117

Top Fix

icon

Upgrade Version

Upgrade to version log4cxx - null;https://github.com/apache/logging-log4cxx.git - rel/v1.5.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): NONE
Integrity (I): HIGH
Availability (A): NONE

Do you need more information?

Contact Us