org.apache.logging.log4j:log4j-1.2-api (Maven) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Maven package org.apache.logging.log4j:log4j-1.2-api, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (1)

• CVE-2026-34479 — CVSS 7.5 (high): The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing…