ByteOS Network

NVD Vulnerability Details :

CVE-2025-54813

Analyzed

Source-security@apache.org

Published At-22 Aug, 2025 | 19:15

Updated At-26 Aug, 2025 | 21:16

Improper Output Neutralization for Logs vulnerability in Apache Log4cxx. When using JSONLayout, not all payload bytes are properly escaped. If an attacker-supplied message contains certain non-printable characters, these will be passed along in the message and written out as part of the JSON message. This may prevent applications that consume these logs from correctly interpreting the information within them. This issue affects Apache Log4cxx: before 1.5.0. Users are recommended to upgrade to version 1.5.0, which fixes the issue.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	4.0	6.3	MEDIUM	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CPE Matches

The Apache Software Foundation

>>log4cxx>>Versions before 1.5.0(exclusive)

cpe:2.3:a:apache:log4cxx:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-117	Primary	security@apache.org

References

Hyperlink	Source	Resource
https://github.com/apache/logging-log4cxx/pull/512	security@apache.org	Issue Tracking Patch
https://logging.apache.org/security.html#CVE-2025-54813	security@apache.org	Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History