Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration attributes. Two distinct issues affect users of stream-based syslog services who configure RFC5424Layout directly: * The newLineEscape attribute was silently renamed, causing newline escaping to stop working for users of TCP framing (RFC 6587), exposing them to CRLF injection in log output. * The useTlsMessageFormat attribute was silently renamed, causing users of TLS framing (RFC 5425) to be silently downgraded to unframed TCP (RFC 6587), without newline escaping. Users of the SyslogAppender are not affected, as its configuration attributes were not modified. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.
Quest Software has completed a technical assessment of CVE 2026 34478 and CVE 2026 34480 as they relate to Stat 7.0.2 and 7.0.3.
While Stat 7.0.3 includes a version of Apache Log4j Core that is technically within the affected version range, the vulnerable code paths described in both CVEs are not reachable in Stat’s runtime configuration. As a result, the reported vulnerabilities do not present a security risk for Stat 7.0.3 and the product can be considered secure to deploy.
No remote code execution, data disclosure, privilege escalation, or denial of service conditions are possible under Stat’s supported configurations. That said, we plan to upgrade these versions in our future release to stay up to date with the latest version.
CVE 2026 34480 – XmlLayout Log Corruption / Event Loss
Description:
Apache Log4j Core’s XmlLayout fails to sanitize XML 1.0 forbidden characters, which may result in malformed XML output or dropped log events under specific conditions.
Key Characteristics:
• Affects only the XmlLayout class
• Requires logging output to be explicitly configured as XML
• Impacts log integrity only (no code execution)
CVE 2026 34478 – CRLF Log Injection in Rfc5424Layout
Description:
Apache Log4j Core’s Rfc5424Layout may allow CRLF injection due to configuration attribute changes, potentially enabling log injection in syslog streams.
Key Characteristics:
• Affects only Rfc5424Layout
• Applies only when Rfc5424Layout is configured directly
• Does not affect users of SyslogAppender
• Fixed in Log4j Core 2.25.4
Log4j Layout Usage in Stat
Stat 7.0.3 does not use the following Log4j layouts:
• XmlLayout
• Rfc5424Layout
Stat uses standard, non XML, non syslog stream layouts for internal application logging. These layouts do not invoke the vulnerable code paths described in either CVE.
As a result:
• The XmlLayout sanitization logic involved in CVE 2026 34480 is never executed.
• The Rfc5424Layout configuration logic involved in CVE 2026 34478 is never executed.
A product Defect with ID: STAT-6523 has been assigned to this vulnerability, and it will be addressed in a future release.
