CVE-2026-40023

A flaw was found in Apache Log4cxx. An attacker who can influence logged data can exploit this by injecting characters forbidden by the XML 1.0 specification (a standard for encoding documents) into log messages, Network Device Configuration (NDC), and Mapped Diagnostic Context (MDC) property keys and values. This results in invalid XML output, causing downstream log processing systems to drop or fail to index affected records. The primary impact is the impairment of audit trails and the detection of malicious activity, leading to a Denial of Service (DoS) for log processing.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.