CVE-2026-40023

medium Red Hat
CVSS v3 Base Score
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score
0.3%
Exploitation probability in 30 days
Top 47% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Published: April 10, 2026 (91 days ago)
Last Modified: April 10, 2026
Vendor: Red Hat
Source: REDHAT

Description

A flaw was found in Apache Log4cxx. An attacker who can influence logged data can exploit this by injecting characters forbidden by the XML 1.0 specification (a standard for encoding documents) into log messages, Network Device Configuration (NDC), and Mapped Diagnostic Context (MDC) property keys and values. This results in invalid XML output, causing downstream log processing systems to drop or fail to index affected records. The primary impact is the impairment of audit trails and the detection of malicious activity, leading to a Denial of Service (DoS) for log processing.

CWE

CWE-117

Affected Products

Red Hat Enterprise Linux 7

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov 🔗 github.com 🔗 lists.apache.org