fad-checker 2.1.0 → 2.1.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (16) hide show
  1. package/README.md +8 -13
  2. package/fad-checker-report/cve-report.doc +643 -105
  3. package/fad-checker-report/cve-report.html +653 -108
  4. package/fad-checker.js +103 -12
  5. package/lib/codecs/index.js +66 -2
  6. package/lib/codecs/maven/jar-scan.js +174 -28
  7. package/lib/codecs/maven.codec.js +2 -2
  8. package/lib/codecs/npm/collect.js +3 -1
  9. package/lib/codecs/npm/parse.js +25 -0
  10. package/lib/codecs/npm.codec.js +5 -1
  11. package/lib/core.js +15 -0
  12. package/lib/cve-report.js +3 -1
  13. package/lib/license-policy.js +3 -1
  14. package/lib/outdated.js +3 -0
  15. package/lib/parallel-walk.js +47 -0
  16. package/package.json +1 -1
package/fad-checker-report/cve-report.doc CHANGED
@@ -298,89 +298,219 @@ tr:nth-child(even) { background: #fafafa; }
298
298
  <h1>FAD-Checker Report</h1>
299
299
  <div class="report-subtitle">Multi-ecosystem dependency security audit</div>
300
300
  <div class="meta">
301
- Project: <strong>emb</strong> · <code class="path">/tmp/emb</code><br>
302
- Generated: 2026-06-01T11:50:17.518Z · fad-checker 2.0.2 · CVE data: 2026-06-01T09:36:42.393Z
301
+ Project: <strong>monorepo-mixed</strong> · <code class="path">/mnt/wsl/WipDrive/_libs/fad-checker/test/fixtures/monorepo-mixed</code><br>
302
+ Generated: 2026-06-02T09:07:09.509Z · fad-checker 2.1.1 · CVE data: 2026-06-01T09:36:42.393Z
303
303
  </div>
304
304
  </header>
305
- <div class="exec-summary exec-medium">
305
+ <div class="exec-summary exec-high">
306
306
  <div class="exec-head">
307
- <span class="exec-level">MEDIUM</span>
307
+ <span class="exec-level">HIGH</span>
308
308
  <span class="exec-title">Executive Summary</span>
309
309
 
310
310
  </div>
311
- <div class="exec-meta">3 dependencies scanned</div>
311
+ <div class="exec-meta">23 dependencies scanned</div>
312
312
  <ul class="exec-bullets">
313
- <li><strong>2</strong> CVE in production deps (critical=0, high=0, medium=1, low=1)</li><li><strong>1</strong> scan-completeness alert — see chapter 0</li>
313
+ <li><strong>3</strong> CVE in production deps (critical=0, high=0, medium=3, low=0)</li><li><strong>1</strong> end-of-life framework</li><li><strong>1</strong> obsolete / deprecated lib</li><li><strong>5</strong> outdated libs</li><li><strong>1</strong> scan-completeness alert — see chapter 0</li>
314
314
  </ul>
315
315
 
316
316
  </div>
317
- <div class="summary"><div class="card sev-critical"><div class="v">0</div><div class="l">Critical</div></div><div class="card sev-high"><div class="v">0</div><div class="l">High</div></div><div class="card sev-medium"><div class="v">1</div><div class="l">Medium</div></div><div class="card sev-low"><div class="v">1</div><div class="l">Low</div></div><div class="card"><div class="v">2</div><div class="l">Total CVEs</div></div><div class="card"><div class="v">2</div><div class="l">in Direct</div></div><div class="card"><div class="v">0</div><div class="l">in Transitive</div></div><div class="card sev-vendored"><div class="v">0</div><div class="l">Vendored JS</div></div><div class="card"><div class="v">0</div><div class="l">EOL</div></div><div class="card"><div class="v">0</div><div class="l">Obsolete</div></div><div class="card"><div class="v">0</div><div class="l">Outdated</div></div><div class="card sev-warn"><div class="v">1</div><div class="l">Scan alerts</div></div></div>
318
- <nav class="toc"><a href="#ch0">0. Warnings</a><a href="#ch1">1. Prod CVE (2)</a><a href="#ch1e">1B. Embedded (3)</a><a href="#ch2">2. Vendored JS (0)</a><a href="#ch3">3. Dev CVE (0)</a><a href="#ch4">4. EOL (0)</a><a href="#ch5">5. Obsolete (0)</a><a href="#ch6">6. Outdated (0)</a><a href="#ch7">7. Licenses (0)</a><a href="#ch8">8. Fix Recos</a></nav>
317
+ <div class="summary"><div class="card sev-critical"><div class="v">0</div><div class="l">Critical</div></div><div class="card sev-high"><div class="v">0</div><div class="l">High</div></div><div class="card sev-medium"><div class="v">3</div><div class="l">Medium</div></div><div class="card sev-low"><div class="v">0</div><div class="l">Low</div></div><div class="card"><div class="v">3</div><div class="l">Total CVEs</div></div><div class="card"><div class="v">3</div><div class="l">in Direct</div></div><div class="card"><div class="v">0</div><div class="l">in Transitive</div></div><div class="card sev-vendored"><div class="v">0</div><div class="l">Vendored JS</div></div><div class="card"><div class="v">1</div><div class="l">EOL</div></div><div class="card"><div class="v">1</div><div class="l">Obsolete</div></div><div class="card"><div class="v">5</div><div class="l">Outdated</div></div><div class="card sev-warn"><div class="v">1</div><div class="l">Scan alerts</div></div></div>
318
+ <nav class="toc"><a href="#ch0">0. Warnings</a><a href="#ch1">1. Prod CVE (3)</a><a href="#ch2">2. Vendored JS (0)</a><a href="#ch3">3. Dev CVE (0)</a><a href="#ch4">4. EOL (1)</a><a href="#ch5">5. Obsolete (1)</a><a href="#ch6">6. Outdated (5)</a><a href="#ch7">7. Licenses (1)</a><a href="#ch8">8. Fix Recos</a></nav>
319
319
 
320
320
 
321
321
  <details class="report-section" open id="ch0">
322
322
  <summary><h2>0. Warnings & scan-completeness (1)</h2></summary>
323
- <div><div class="warnings warnings-chapter"><div class="warn-block warn-embedded-jar">
324
- <div class="warn-head">⚠️ <strong>embedded-jar</strong></div>
325
-
326
- <div class="warn-msg">embedded archive with no resolvable Maven coordinate (not scanned): dist/app.jar!/BOOT-INF/lib/mystery.jar</div>
323
+ <div><div class="warnings warnings-chapter"><div class="warn-block warn-no-lockfile">
324
+ <div class="warn-head">⚠️ <strong>JS manifest without lockfile</strong></div>
325
+ <div class="warn-path"><code>packages/no-lock/package.json</code></div>
326
+ <div class="warn-msg">package.json without lockfile — best-effort: 1 pinned dep(s) scanned, 2 range(s) skipped (run &quot;npm install&quot; or &quot;yarn install&quot; for full coverage)</div>
327
327
 
328
328
  </div></div></div>
329
329
  </details>
330
330
  <details class="report-section" open id="ch1">
331
- <summary><h2>1. CVE Vulnerabilities — production (2)</h2></summary>
331
+ <summary><h2>1. CVE Vulnerabilities — production (3)</h2></summary>
332
332
  <div><details class="report-subsection" open>
333
- <summary><h3>1.a Maven (2)</h3></summary>
333
+ <summary><h3>1.a Maven (3)</h3></summary>
334
334
  <div><details class="report-subsection" open>
335
- <summary><h3>1.a.0 All (2)</h3></summary>
335
+ <summary><h3>1.a.0 All (3)</h3></summary>
336
336
  <div><details class="report-subsection" open>
337
- <summary><h3>All — direct (2)</h3></summary>
337
+ <summary><h3>All — direct (3)</h3></summary>
338
338
  <div><table border="1" cellspacing="0" cellpadding="4" width="100%" style="width:100%;border-collapse:collapse;table-layout:fixed"><colgroup><col style="width:9%"><col style="width:7%"><col style="width:9%"><col style="width:14%"><col style="width:9%"><col style="width:6%"><col style="width:22%"><col style="width:10%"><col style="width:14%"></colgroup><thead><tr><th>Priority</th><th>Severity</th><th>CVE ID</th><th>Dependency</th><th>CWE</th><th>Published</th><th>Description</th><th>Fix Version</th><th>Source</th></tr></thead>
339
339
  <tbody><tr class="cve-row open">
340
340
  <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span></td>
341
- <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">5.5</div></td>
342
- <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2023-2976" target="_blank">CVE-2023-2976</a><div class="confidence">probable</div></td>
343
- <td class="dep">com.google.guava:<br>guava<br><span style="color:#6b7280">30.0-jre</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code></div></td>
344
- <td class="cwe"><span class="cwe-empty">—</span></td>
345
- <td class="published">—</td>
346
- <td class="desc">Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the defaul…</td>
347
- <td class="dep">32.0.0</td>
348
- <td><span class="source fad">fad</span></td>
341
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
342
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-68161" target="_blank">CVE-2025-68161</a><div class="confidence">exact</div></td>
343
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
344
+ <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
345
+ <td class="published">2025-12-18</td>
346
+ <td class="desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#…</td>
347
+ <td class="dep">2.25.3</td>
348
+ <td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
349
349
 
350
350
  </tr>
351
351
  <tr class="detail-row open"><td colspan="9"><div class="detail-panel"><div class="panel-block">
352
352
  <div class="panel-title">Description</div>
353
- <div><div class="full-desc">Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.
353
+ <div><div class="full-desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true.
354
+
355
+ This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:
354
356
 
355
- Even though the security vulnerability is fixed in version 32.0.0, we recommend…</div></div>
357
+ * The attacker is able to intercept or redirect network traffic between the client and the log receiver.
358
+ * The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).
359
+
360
+
361
+ Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.
362
+
363
+ As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.</div></div>
364
+ </div><div class="panel-block">
365
+ <div class="panel-title">Weaknesses (CWE) <span class="count">(2)</span></div>
366
+ <div><ul class="cwe-list"><li>
367
+ <a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link">CWE-297</a>
368
+ <span class="cwe-name-inline">— Improper Validation of Certificate with Host Mismatch</span>
369
+ </li><li>
370
+ <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link">CWE-295</a>
371
+ <span class="cwe-name-inline">— Improper Certificate Validation</span>
372
+ </li></ul></div>
356
373
  </div><div class="panel-block">
357
374
  <div class="panel-title">Metadata</div>
358
- <div><div class="kv"><div><label>Base score</label><span>5.5 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 55/100</span></div><div><label>Fix version</label><span>32.0.0</span></div><div><label>Match confidence</label><span>probable</span></div><div><label>Sources</label><span>fad</span></div></div></div>
375
+ <div><div class="kv"><div><label>CVSS:4.0</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 63/100</span></div><div><label>Fix version</label><span>2.25.3</span></div><div><label>Published</label><span>2025-12-18</span></div><div><label>Modified</label><span>2026-01-20</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
376
+ </div><div class="panel-block">
377
+ <div class="panel-title">External links <span class="count">(8)</span></div>
378
+ <div><div class="ref-group">
379
+ <span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
380
+ <ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4002" target="_blank">https://github.com/apache/logging-log4j2/pull/4002</a></li></ul>
381
+ </div><div class="ref-group">
382
+ <span class="ref-label exploit">Exploit / PoC</span><span style="color:#9ca3af;font-size:11px">1 link</span>
383
+ <ul class="ref-list"><li><a href="https://logging.apache.org/security.html#CVE-2025-68161" target="_blank">https://logging.apache.org/security.html#CVE-2025-68161</a></li></ul>
384
+ </div><div class="ref-group">
385
+ <span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">1 link</span>
386
+ <ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li></ul>
387
+ </div><div class="ref-group">
388
+ <span class="ref-label mailing">Mailing list</span><span style="color:#9ca3af;font-size:11px">3 links</span>
389
+ <ul class="ref-list"><li><a href="https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx" target="_blank">https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx</a></li><li><a href="http://www.openwall.com/lists/oss-security/2025/12/18/1" target="_blank">http://www.openwall.com/lists/oss-security/2025/12/18/1</a></li><li><a href="https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html" target="_blank">https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html</a></li></ul>
390
+ </div><div class="ref-group">
391
+ <span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">2 links</span>
392
+ <ul class="ref-list"><li><a href="https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName</a></li><li><a href="https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName</a></li></ul>
393
+ </div></div>
359
394
  </div><div class="panel-block">
360
- <div class="panel-title">Declared in <span class="count">(1 POM)</span></div>
361
- <div><div class="via-list"><div>pom.xml</div></div></div>
395
+ <div class="panel-title">Affected CPE configurations <span class="count">(6)</span></div>
396
+ <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc1-rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*</li></ul></div>
397
+ </div><div class="panel-block">
398
+ <div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
399
+ <div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
362
400
  </div></div></td></tr>
363
401
  <tr class="cve-row open">
364
- <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#2563eb;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">LOW</span></td>
365
- <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#3b82f6;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">LOW</span><div class="confidence">3.3</div></td>
366
- <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2020-8908" target="_blank">CVE-2020-8908</a><div class="confidence">probable</div></td>
367
- <td class="dep">com.google.guava:<br>guava<br><span style="color:#6b7280">30.0-jre</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code></div></td>
368
- <td class="cwe"><span class="cwe-empty">—</span></td>
369
- <td class="published">—</td>
370
- <td class="desc">A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir()…</td>
371
- <td class="dep">32.0</td>
372
- <td><span class="source fad">fad</span></td>
402
+ <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 11%</div></td>
403
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.9</div></td>
404
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34480" target="_blank">CVE-2026-34480</a><div class="confidence">exact</div></td>
405
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
406
+ <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/116.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-116: Improper Encoding or Escaping of Output">CWE-116</a><div class="cwe-name">Improper Encoding or Escaping of Output</div></td>
407
+ <td class="published">2026-04-10</td>
408
+ <td class="desc">Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#char…</td>
409
+ <td class="dep">2.25.4</td>
410
+ <td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
373
411
 
374
412
  </tr>
375
413
  <tr class="detail-row open"><td colspan="9"><div class="detail-panel"><div class="panel-block">
376
414
  <div class="panel-title">Description</div>
377
- <div><div class="full-desc">A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been…</div></div>
415
+ <div><div class="full-desc">Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters.
416
+
417
+ The impact depends on the StAX implementation in use:
418
+
419
+ * JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
420
+ * Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.
421
+
422
+
423
+ Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.</div></div>
424
+ </div><div class="panel-block">
425
+ <div class="panel-title">Weaknesses (CWE) <span class="count">(1)</span></div>
426
+ <div><ul class="cwe-list"><li>
427
+ <a href="https://cwe.mitre.org/data/definitions/116.html" target="_blank" rel="noopener" class="cwe-link">CWE-116</a>
428
+ <span class="cwe-name-inline">— Improper Encoding or Escaping of Output</span>
429
+ </li></ul></div>
378
430
  </div><div class="panel-block">
379
431
  <div class="panel-title">Metadata</div>
380
- <div><div class="kv"><div><label>Base score</label><span>3.3 (LOW)</span></div><div><label>Priority</label><span>LOW · 33/100</span></div><div><label>Fix version</label><span>32.0</span></div><div><label>Match confidence</label><span>probable</span></div><div><label>Sources</label><span>fad</span></div></div></div>
432
+ <div><div class="kv"><div><label>CVSS:V40</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.9 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 57.3/100</span></div><div><label>EPSS</label><span>0.0% prob · 11th pct</span></div><div><label>Fix version</label><span>2.25.4</span></div><div><label>Published</label><span>2026-04-10</span></div><div><label>Modified</label><span>2026-04-24</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
381
433
  </div><div class="panel-block">
382
- <div class="panel-title">Declared in <span class="count">(1 POM)</span></div>
383
- <div><div class="via-list"><div>pom.xml</div></div></div>
434
+ <div class="panel-title">External links <span class="count">(6)</span></div>
435
+ <div><div class="ref-group">
436
+ <span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
437
+ <ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4077" target="_blank">https://github.com/apache/logging-log4j2/pull/4077</a></li></ul>
438
+ </div><div class="ref-group">
439
+ <span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">2 links</span>
440
+ <ul class="ref-list"><li><a href="https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb" target="_blank">https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb</a></li><li><a href="https://logging.apache.org/security.html#CVE-2026-34480" target="_blank">https://logging.apache.org/security.html#CVE-2026-34480</a></li></ul>
441
+ </div><div class="ref-group">
442
+ <span class="ref-label third-party">Third-party advisory</span><span style="color:#9ca3af;font-size:11px">1 link</span>
443
+ <ul class="ref-list"><li><a href="http://www.openwall.com/lists/oss-security/2026/04/10/9" target="_blank">http://www.openwall.com/lists/oss-security/2026/04/10/9</a></li></ul>
444
+ </div><div class="ref-group">
445
+ <span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">2 links</span>
446
+ <ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li><li><a href="https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout" target="_blank">https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout</a></li></ul>
447
+ </div></div>
448
+ </div><div class="panel-block">
449
+ <div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
450
+ <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
451
+ </div><div class="panel-block">
452
+ <div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
453
+ <div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
454
+ </div></div></td></tr>
455
+ <tr class="cve-row open">
456
+ <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 12%</div></td>
457
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
458
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34477" target="_blank">CVE-2026-34477</a><div class="confidence">exact</div></td>
459
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
460
+ <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
461
+ <td class="published">2026-04-10</td>
462
+ <td class="desc">The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systempr…</td>
463
+ <td class="dep">2.25.4</td>
464
+ <td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
465
+
466
+ </tr>
467
+ <tr class="detail-row open"><td colspan="9"><div class="detail-panel"><div class="panel-block">
468
+ <div class="panel-title">Description</div>
469
+ <div><div class="full-desc">The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the &lt;Ssl&gt; element.
470
+
471
+ Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.
472
+
473
+ A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:
474
+
475
+ * An SMTP, Socket, or Syslog appender is in use.
476
+ * TLS is configured via a nested &lt;Ssl&gt; element.
477
+ * The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured.
478
+ This issue does not affect users of the HTTP appender, which uses a separate verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName attribute that was not subject to this bug and verifies host names by default.
479
+
480
+ Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.</div></div>
481
+ </div><div class="panel-block">
482
+ <div class="panel-title">Weaknesses (CWE) <span class="count">(2)</span></div>
483
+ <div><ul class="cwe-list"><li>
484
+ <a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link">CWE-297</a>
485
+ <span class="cwe-name-inline">— Improper Validation of Certificate with Host Mismatch</span>
486
+ </li><li>
487
+ <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link">CWE-295</a>
488
+ <span class="cwe-name-inline">— Improper Certificate Validation</span>
489
+ </li></ul></div>
490
+ </div><div class="panel-block">
491
+ <div class="panel-title">Metadata</div>
492
+ <div><div class="kv"><div><label>CVSS:V40</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 52.8/100</span></div><div><label>EPSS</label><span>0.0% prob · 12th pct</span></div><div><label>Fix version</label><span>2.25.4</span></div><div><label>Published</label><span>2026-04-10</span></div><div><label>Modified</label><span>2026-05-06</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
493
+ </div><div class="panel-block">
494
+ <div class="panel-title">External links <span class="count">(5)</span></div>
495
+ <div><div class="ref-group">
496
+ <span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
497
+ <ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4075" target="_blank">https://github.com/apache/logging-log4j2/pull/4075</a></li></ul>
498
+ </div><div class="ref-group">
499
+ <span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">2 links</span>
500
+ <ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li><li><a href="https://logging.apache.org/security.html#CVE-2026-34477" target="_blank">https://logging.apache.org/security.html#CVE-2026-34477</a></li></ul>
501
+ </div><div class="ref-group">
502
+ <span class="ref-label mailing">Mailing list</span><span style="color:#9ca3af;font-size:11px">1 link</span>
503
+ <ul class="ref-list"><li><a href="https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4" target="_blank">https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4</a></li></ul>
504
+ </div><div class="ref-group">
505
+ <span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">1 link</span>
506
+ <ul class="ref-list"><li><a href="https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName</a></li></ul>
507
+ </div></div>
508
+ </div><div class="panel-block">
509
+ <div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
510
+ <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
511
+ </div><div class="panel-block">
512
+ <div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
513
+ <div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
384
514
  </div></div></td></tr></tbody>
385
515
  </table></div>
386
516
  </details><details class="report-subsection" open>
@@ -388,91 +518,437 @@ Even though the security vulnerability is fixed in version 32.0.0, we recommend
388
518
  <div><div class="empty">No CVEs matched.</div></div>
389
519
  </details></div>
390
520
  </details><details class="report-subsection" open>
391
- <summary><h3>By pom.xml (1 file)</h3></summary>
521
+ <summary><h3>By pom.xml (3 files)</h3></summary>
392
522
  <div><details class="report-subsection" open>
393
- <summary><h3><code class="path">pom.xml</code> (2)</h3></summary>
523
+ <summary><h3><code class="path">libs/common-bom/pom.xml</code> (3)</h3></summary>
394
524
  <div><table border="1" cellspacing="0" cellpadding="4" width="100%" style="width:100%;border-collapse:collapse;table-layout:fixed"><colgroup><col style="width:9%"><col style="width:7%"><col style="width:9%"><col style="width:14%"><col style="width:9%"><col style="width:6%"><col style="width:22%"><col style="width:10%"><col style="width:14%"></colgroup><thead><tr><th>Priority</th><th>Severity</th><th>CVE ID</th><th>Dependency</th><th>CWE</th><th>Published</th><th>Description</th><th>Fix Version</th><th>Source</th></tr></thead>
395
525
  <tbody><tr class="cve-row open">
396
526
  <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span></td>
397
- <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">5.5</div></td>
398
- <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2023-2976" target="_blank">CVE-2023-2976</a><div class="confidence">probable</div></td>
399
- <td class="dep">com.google.guava:<br>guava<br><span style="color:#6b7280">30.0-jre</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code></div></td>
400
- <td class="cwe"><span class="cwe-empty">—</span></td>
401
- <td class="published">—</td>
402
- <td class="desc">Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the defaul…</td>
403
- <td class="dep">32.0.0</td>
404
- <td><span class="source fad">fad</span></td>
527
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
528
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-68161" target="_blank">CVE-2025-68161</a><div class="confidence">exact</div></td>
529
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
530
+ <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
531
+ <td class="published">2025-12-18</td>
532
+ <td class="desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#…</td>
533
+ <td class="dep">2.25.3</td>
534
+ <td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
405
535
 
406
536
  </tr>
407
537
  <tr class="detail-row open"><td colspan="9"><div class="detail-panel"><div class="panel-block">
408
538
  <div class="panel-title">Description</div>
409
- <div><div class="full-desc">Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class.
539
+ <div><div class="full-desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true.
540
+
541
+ This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:
542
+
543
+ * The attacker is able to intercept or redirect network traffic between the client and the log receiver.
544
+ * The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).
410
545
 
411
- Even though the security vulnerability is fixed in version 32.0.0, we recommend…</div></div>
546
+
547
+ Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.
548
+
549
+ As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.</div></div>
550
+ </div><div class="panel-block">
551
+ <div class="panel-title">Weaknesses (CWE) <span class="count">(2)</span></div>
552
+ <div><ul class="cwe-list"><li>
553
+ <a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link">CWE-297</a>
554
+ <span class="cwe-name-inline">— Improper Validation of Certificate with Host Mismatch</span>
555
+ </li><li>
556
+ <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link">CWE-295</a>
557
+ <span class="cwe-name-inline">— Improper Certificate Validation</span>
558
+ </li></ul></div>
412
559
  </div><div class="panel-block">
413
560
  <div class="panel-title">Metadata</div>
414
- <div><div class="kv"><div><label>Base score</label><span>5.5 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 55/100</span></div><div><label>Fix version</label><span>32.0.0</span></div><div><label>Match confidence</label><span>probable</span></div><div><label>Sources</label><span>fad</span></div></div></div>
561
+ <div><div class="kv"><div><label>CVSS:4.0</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 63/100</span></div><div><label>Fix version</label><span>2.25.3</span></div><div><label>Published</label><span>2025-12-18</span></div><div><label>Modified</label><span>2026-01-20</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
562
+ </div><div class="panel-block">
563
+ <div class="panel-title">External links <span class="count">(8)</span></div>
564
+ <div><div class="ref-group">
565
+ <span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
566
+ <ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4002" target="_blank">https://github.com/apache/logging-log4j2/pull/4002</a></li></ul>
567
+ </div><div class="ref-group">
568
+ <span class="ref-label exploit">Exploit / PoC</span><span style="color:#9ca3af;font-size:11px">1 link</span>
569
+ <ul class="ref-list"><li><a href="https://logging.apache.org/security.html#CVE-2025-68161" target="_blank">https://logging.apache.org/security.html#CVE-2025-68161</a></li></ul>
570
+ </div><div class="ref-group">
571
+ <span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">1 link</span>
572
+ <ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li></ul>
573
+ </div><div class="ref-group">
574
+ <span class="ref-label mailing">Mailing list</span><span style="color:#9ca3af;font-size:11px">3 links</span>
575
+ <ul class="ref-list"><li><a href="https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx" target="_blank">https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx</a></li><li><a href="http://www.openwall.com/lists/oss-security/2025/12/18/1" target="_blank">http://www.openwall.com/lists/oss-security/2025/12/18/1</a></li><li><a href="https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html" target="_blank">https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html</a></li></ul>
576
+ </div><div class="ref-group">
577
+ <span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">2 links</span>
578
+ <ul class="ref-list"><li><a href="https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName</a></li><li><a href="https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName</a></li></ul>
579
+ </div></div>
580
+ </div><div class="panel-block">
581
+ <div class="panel-title">Affected CPE configurations <span class="count">(6)</span></div>
582
+ <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc1-rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*</li></ul></div>
415
583
  </div><div class="panel-block">
416
- <div class="panel-title">Declared in <span class="count">(1 POM)</span></div>
417
- <div><div class="via-list"><div>pom.xml</div></div></div>
584
+ <div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
585
+ <div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
418
586
  </div></div></td></tr>
419
587
  <tr class="cve-row open">
420
- <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#2563eb;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">LOW</span></td>
421
- <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#3b82f6;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">LOW</span><div class="confidence">3.3</div></td>
422
- <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2020-8908" target="_blank">CVE-2020-8908</a><div class="confidence">probable</div></td>
423
- <td class="dep">com.google.guava:<br>guava<br><span style="color:#6b7280">30.0-jre</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code></div></td>
424
- <td class="cwe"><span class="cwe-empty">—</span></td>
425
- <td class="published">—</td>
426
- <td class="desc">A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir()…</td>
427
- <td class="dep">32.0</td>
428
- <td><span class="source fad">fad</span></td>
588
+ <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 11%</div></td>
589
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.9</div></td>
590
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34480" target="_blank">CVE-2026-34480</a><div class="confidence">exact</div></td>
591
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
592
+ <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/116.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-116: Improper Encoding or Escaping of Output">CWE-116</a><div class="cwe-name">Improper Encoding or Escaping of Output</div></td>
593
+ <td class="published">2026-04-10</td>
594
+ <td class="desc">Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#char…</td>
595
+ <td class="dep">2.25.4</td>
596
+ <td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
429
597
 
430
598
  </tr>
431
599
  <tr class="detail-row open"><td colspan="9"><div class="detail-panel"><div class="panel-block">
432
600
  <div class="panel-title">Description</div>
433
- <div><div class="full-desc">A temp directory creation vulnerability exists in all versions of Guava, allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava API com.google.common.io.Files.createTempDir(). By default, on unix-like systems, the created directory is world-readable (readable by an attacker with access to the system). The method in question has been…</div></div>
601
+ <div><div class="full-desc">Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters.
602
+
603
+ The impact depends on the StAX implementation in use:
604
+
605
+ * JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
606
+ * Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.
607
+
608
+
609
+ Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.</div></div>
610
+ </div><div class="panel-block">
611
+ <div class="panel-title">Weaknesses (CWE) <span class="count">(1)</span></div>
612
+ <div><ul class="cwe-list"><li>
613
+ <a href="https://cwe.mitre.org/data/definitions/116.html" target="_blank" rel="noopener" class="cwe-link">CWE-116</a>
614
+ <span class="cwe-name-inline">— Improper Encoding or Escaping of Output</span>
615
+ </li></ul></div>
434
616
  </div><div class="panel-block">
435
617
  <div class="panel-title">Metadata</div>
436
- <div><div class="kv"><div><label>Base score</label><span>3.3 (LOW)</span></div><div><label>Priority</label><span>LOW · 33/100</span></div><div><label>Fix version</label><span>32.0</span></div><div><label>Match confidence</label><span>probable</span></div><div><label>Sources</label><span>fad</span></div></div></div>
618
+ <div><div class="kv"><div><label>CVSS:V40</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.9 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 57.3/100</span></div><div><label>EPSS</label><span>0.0% prob · 11th pct</span></div><div><label>Fix version</label><span>2.25.4</span></div><div><label>Published</label><span>2026-04-10</span></div><div><label>Modified</label><span>2026-04-24</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
437
619
  </div><div class="panel-block">
438
- <div class="panel-title">Declared in <span class="count">(1 POM)</span></div>
439
- <div><div class="via-list"><div>pom.xml</div></div></div>
620
+ <div class="panel-title">External links <span class="count">(6)</span></div>
621
+ <div><div class="ref-group">
622
+ <span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
623
+ <ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4077" target="_blank">https://github.com/apache/logging-log4j2/pull/4077</a></li></ul>
624
+ </div><div class="ref-group">
625
+ <span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">2 links</span>
626
+ <ul class="ref-list"><li><a href="https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb" target="_blank">https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb</a></li><li><a href="https://logging.apache.org/security.html#CVE-2026-34480" target="_blank">https://logging.apache.org/security.html#CVE-2026-34480</a></li></ul>
627
+ </div><div class="ref-group">
628
+ <span class="ref-label third-party">Third-party advisory</span><span style="color:#9ca3af;font-size:11px">1 link</span>
629
+ <ul class="ref-list"><li><a href="http://www.openwall.com/lists/oss-security/2026/04/10/9" target="_blank">http://www.openwall.com/lists/oss-security/2026/04/10/9</a></li></ul>
630
+ </div><div class="ref-group">
631
+ <span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">2 links</span>
632
+ <ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li><li><a href="https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout" target="_blank">https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout</a></li></ul>
633
+ </div></div>
634
+ </div><div class="panel-block">
635
+ <div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
636
+ <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
637
+ </div><div class="panel-block">
638
+ <div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
639
+ <div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
640
+ </div></div></td></tr>
641
+ <tr class="cve-row open">
642
+ <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 12%</div></td>
643
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
644
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34477" target="_blank">CVE-2026-34477</a><div class="confidence">exact</div></td>
645
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
646
+ <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
647
+ <td class="published">2026-04-10</td>
648
+ <td class="desc">The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systempr…</td>
649
+ <td class="dep">2.25.4</td>
650
+ <td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
651
+
652
+ </tr>
653
+ <tr class="detail-row open"><td colspan="9"><div class="detail-panel"><div class="panel-block">
654
+ <div class="panel-title">Description</div>
655
+ <div><div class="full-desc">The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the &lt;Ssl&gt; element.
656
+
657
+ Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.
658
+
659
+ A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:
660
+
661
+ * An SMTP, Socket, or Syslog appender is in use.
662
+ * TLS is configured via a nested &lt;Ssl&gt; element.
663
+ * The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured.
664
+ This issue does not affect users of the HTTP appender, which uses a separate verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName attribute that was not subject to this bug and verifies host names by default.
665
+
666
+ Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.</div></div>
667
+ </div><div class="panel-block">
668
+ <div class="panel-title">Weaknesses (CWE) <span class="count">(2)</span></div>
669
+ <div><ul class="cwe-list"><li>
670
+ <a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link">CWE-297</a>
671
+ <span class="cwe-name-inline">— Improper Validation of Certificate with Host Mismatch</span>
672
+ </li><li>
673
+ <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link">CWE-295</a>
674
+ <span class="cwe-name-inline">— Improper Certificate Validation</span>
675
+ </li></ul></div>
676
+ </div><div class="panel-block">
677
+ <div class="panel-title">Metadata</div>
678
+ <div><div class="kv"><div><label>CVSS:V40</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 52.8/100</span></div><div><label>EPSS</label><span>0.0% prob · 12th pct</span></div><div><label>Fix version</label><span>2.25.4</span></div><div><label>Published</label><span>2026-04-10</span></div><div><label>Modified</label><span>2026-05-06</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
679
+ </div><div class="panel-block">
680
+ <div class="panel-title">External links <span class="count">(5)</span></div>
681
+ <div><div class="ref-group">
682
+ <span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
683
+ <ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4075" target="_blank">https://github.com/apache/logging-log4j2/pull/4075</a></li></ul>
684
+ </div><div class="ref-group">
685
+ <span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">2 links</span>
686
+ <ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li><li><a href="https://logging.apache.org/security.html#CVE-2026-34477" target="_blank">https://logging.apache.org/security.html#CVE-2026-34477</a></li></ul>
687
+ </div><div class="ref-group">
688
+ <span class="ref-label mailing">Mailing list</span><span style="color:#9ca3af;font-size:11px">1 link</span>
689
+ <ul class="ref-list"><li><a href="https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4" target="_blank">https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4</a></li></ul>
690
+ </div><div class="ref-group">
691
+ <span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">1 link</span>
692
+ <ul class="ref-list"><li><a href="https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName</a></li></ul>
693
+ </div></div>
694
+ </div><div class="panel-block">
695
+ <div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
696
+ <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
697
+ </div><div class="panel-block">
698
+ <div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
699
+ <div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
440
700
  </div></div></td></tr></tbody>
441
701
  </table></div>
442
- </details></div>
443
- </details></div>
444
- </details></div>
445
- </details>
446
- <details class="report-section" open id="ch1e">
447
- <summary><h2>1B. Embedded binaries — JAR/WAR/EAR (3)</h2></summary>
448
- <div><div class="fp-intro">Maven coordinates discovered inside committed <code>.jar</code>/<code>.war</code>/<code>.ear</code> binaries (vendored libs, fat-jars) — not declared in any <code>pom.xml</code>. Patch by rebuilding/replacing the containing archive.</div><div class="eco-block"><h3 class="eco-h">📦 dist/app.jar <span class="eco-count">(3)</span></h3><table border="1" cellspacing="0" cellpadding="4" width="100%" style="width:100%;border-collapse:collapse;table-layout:fixed"><colgroup><col style="width:9%"><col style="width:7%"><col style="width:9%"><col style="width:14%"><col style="width:9%"><col style="width:6%"><col style="width:22%"><col style="width:10%"><col style="width:14%"></colgroup><thead><tr><th>Priority</th><th>Severity</th><th>CVE ID</th><th>Dependency</th><th>CWE</th><th>Published</th><th>Description</th><th>Fix Version</th><th>Source</th></tr></thead>
702
+ </details><details class="report-subsection" open>
703
+ <summary><h3><code class="path">pom.xml</code> (3)</h3></summary>
704
+ <div><table border="1" cellspacing="0" cellpadding="4" width="100%" style="width:100%;border-collapse:collapse;table-layout:fixed"><colgroup><col style="width:9%"><col style="width:7%"><col style="width:9%"><col style="width:14%"><col style="width:9%"><col style="width:6%"><col style="width:22%"><col style="width:10%"><col style="width:14%"></colgroup><thead><tr><th>Priority</th><th>Severity</th><th>CVE ID</th><th>Dependency</th><th>CWE</th><th>Published</th><th>Description</th><th>Fix Version</th><th>Source</th></tr></thead>
705
+ <tbody><tr class="cve-row open">
706
+ <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span></td>
707
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
708
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-68161" target="_blank">CVE-2025-68161</a><div class="confidence">exact</div></td>
709
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
710
+ <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
711
+ <td class="published">2025-12-18</td>
712
+ <td class="desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#…</td>
713
+ <td class="dep">2.25.3</td>
714
+ <td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
715
+
716
+ </tr>
717
+ <tr class="detail-row open"><td colspan="9"><div class="detail-panel"><div class="panel-block">
718
+ <div class="panel-title">Description</div>
719
+ <div><div class="full-desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true.
720
+
721
+ This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:
722
+
723
+ * The attacker is able to intercept or redirect network traffic between the client and the log receiver.
724
+ * The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).
725
+
726
+
727
+ Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.
728
+
729
+ As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.</div></div>
730
+ </div><div class="panel-block">
731
+ <div class="panel-title">Weaknesses (CWE) <span class="count">(2)</span></div>
732
+ <div><ul class="cwe-list"><li>
733
+ <a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link">CWE-297</a>
734
+ <span class="cwe-name-inline">— Improper Validation of Certificate with Host Mismatch</span>
735
+ </li><li>
736
+ <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link">CWE-295</a>
737
+ <span class="cwe-name-inline">— Improper Certificate Validation</span>
738
+ </li></ul></div>
739
+ </div><div class="panel-block">
740
+ <div class="panel-title">Metadata</div>
741
+ <div><div class="kv"><div><label>CVSS:4.0</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 63/100</span></div><div><label>Fix version</label><span>2.25.3</span></div><div><label>Published</label><span>2025-12-18</span></div><div><label>Modified</label><span>2026-01-20</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
742
+ </div><div class="panel-block">
743
+ <div class="panel-title">External links <span class="count">(8)</span></div>
744
+ <div><div class="ref-group">
745
+ <span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
746
+ <ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4002" target="_blank">https://github.com/apache/logging-log4j2/pull/4002</a></li></ul>
747
+ </div><div class="ref-group">
748
+ <span class="ref-label exploit">Exploit / PoC</span><span style="color:#9ca3af;font-size:11px">1 link</span>
749
+ <ul class="ref-list"><li><a href="https://logging.apache.org/security.html#CVE-2025-68161" target="_blank">https://logging.apache.org/security.html#CVE-2025-68161</a></li></ul>
750
+ </div><div class="ref-group">
751
+ <span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">1 link</span>
752
+ <ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li></ul>
753
+ </div><div class="ref-group">
754
+ <span class="ref-label mailing">Mailing list</span><span style="color:#9ca3af;font-size:11px">3 links</span>
755
+ <ul class="ref-list"><li><a href="https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx" target="_blank">https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx</a></li><li><a href="http://www.openwall.com/lists/oss-security/2025/12/18/1" target="_blank">http://www.openwall.com/lists/oss-security/2025/12/18/1</a></li><li><a href="https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html" target="_blank">https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html</a></li></ul>
756
+ </div><div class="ref-group">
757
+ <span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">2 links</span>
758
+ <ul class="ref-list"><li><a href="https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName</a></li><li><a href="https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName</a></li></ul>
759
+ </div></div>
760
+ </div><div class="panel-block">
761
+ <div class="panel-title">Affected CPE configurations <span class="count">(6)</span></div>
762
+ <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc1-rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*</li></ul></div>
763
+ </div><div class="panel-block">
764
+ <div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
765
+ <div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
766
+ </div></div></td></tr>
767
+ <tr class="cve-row open">
768
+ <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 11%</div></td>
769
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.9</div></td>
770
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34480" target="_blank">CVE-2026-34480</a><div class="confidence">exact</div></td>
771
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
772
+ <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/116.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-116: Improper Encoding or Escaping of Output">CWE-116</a><div class="cwe-name">Improper Encoding or Escaping of Output</div></td>
773
+ <td class="published">2026-04-10</td>
774
+ <td class="desc">Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#char…</td>
775
+ <td class="dep">2.25.4</td>
776
+ <td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
777
+
778
+ </tr>
779
+ <tr class="detail-row open"><td colspan="9"><div class="detail-panel"><div class="panel-block">
780
+ <div class="panel-title">Description</div>
781
+ <div><div class="full-desc">Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing invalid XML output whenever a log message or MDC value contains such characters.
782
+
783
+ The impact depends on the StAX implementation in use:
784
+
785
+ * JRE built-in StAX: Forbidden characters are silently written to the output, producing malformed XML. Conforming parsers must reject such documents with a fatal error, which may cause downstream log-processing systems to drop the affected records.
786
+ * Alternative StAX implementations (e.g., Woodstox https://github.com/FasterXML/woodstox , a transitive dependency of the Jackson XML Dataformat module): An exception is thrown during the logging call, and the log event is never delivered to its intended appender, only to Log4j's internal status logger.
787
+
788
+
789
+ Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue by sanitizing forbidden characters before XML output.</div></div>
790
+ </div><div class="panel-block">
791
+ <div class="panel-title">Weaknesses (CWE) <span class="count">(1)</span></div>
792
+ <div><ul class="cwe-list"><li>
793
+ <a href="https://cwe.mitre.org/data/definitions/116.html" target="_blank" rel="noopener" class="cwe-link">CWE-116</a>
794
+ <span class="cwe-name-inline">— Improper Encoding or Escaping of Output</span>
795
+ </li></ul></div>
796
+ </div><div class="panel-block">
797
+ <div class="panel-title">Metadata</div>
798
+ <div><div class="kv"><div><label>CVSS:V40</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.9 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 57.3/100</span></div><div><label>EPSS</label><span>0.0% prob · 11th pct</span></div><div><label>Fix version</label><span>2.25.4</span></div><div><label>Published</label><span>2026-04-10</span></div><div><label>Modified</label><span>2026-04-24</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
799
+ </div><div class="panel-block">
800
+ <div class="panel-title">External links <span class="count">(6)</span></div>
801
+ <div><div class="ref-group">
802
+ <span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
803
+ <ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4077" target="_blank">https://github.com/apache/logging-log4j2/pull/4077</a></li></ul>
804
+ </div><div class="ref-group">
805
+ <span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">2 links</span>
806
+ <ul class="ref-list"><li><a href="https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb" target="_blank">https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb</a></li><li><a href="https://logging.apache.org/security.html#CVE-2026-34480" target="_blank">https://logging.apache.org/security.html#CVE-2026-34480</a></li></ul>
807
+ </div><div class="ref-group">
808
+ <span class="ref-label third-party">Third-party advisory</span><span style="color:#9ca3af;font-size:11px">1 link</span>
809
+ <ul class="ref-list"><li><a href="http://www.openwall.com/lists/oss-security/2026/04/10/9" target="_blank">http://www.openwall.com/lists/oss-security/2026/04/10/9</a></li></ul>
810
+ </div><div class="ref-group">
811
+ <span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">2 links</span>
812
+ <ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li><li><a href="https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout" target="_blank">https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout</a></li></ul>
813
+ </div></div>
814
+ </div><div class="panel-block">
815
+ <div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
816
+ <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
817
+ </div><div class="panel-block">
818
+ <div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
819
+ <div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
820
+ </div></div></td></tr>
821
+ <tr class="cve-row open">
822
+ <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 12%</div></td>
823
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
824
+ <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34477" target="_blank">CVE-2026-34477</a><div class="confidence">exact</div></td>
825
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
826
+ <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
827
+ <td class="published">2026-04-10</td>
828
+ <td class="desc">The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systempr…</td>
829
+ <td class="dep">2.25.4</td>
830
+ <td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
831
+
832
+ </tr>
833
+ <tr class="detail-row open"><td colspan="9"><div class="detail-panel"><div class="panel-block">
834
+ <div class="panel-title">Description</div>
835
+ <div><div class="full-desc">The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the &lt;Ssl&gt; element.
836
+
837
+ Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.
838
+
839
+ A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met:
840
+
841
+ * An SMTP, Socket, or Syslog appender is in use.
842
+ * TLS is configured via a nested &lt;Ssl&gt; element.
843
+ * The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured.
844
+ This issue does not affect users of the HTTP appender, which uses a separate verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName attribute that was not subject to this bug and verifies host names by default.
845
+
846
+ Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.</div></div>
847
+ </div><div class="panel-block">
848
+ <div class="panel-title">Weaknesses (CWE) <span class="count">(2)</span></div>
849
+ <div><ul class="cwe-list"><li>
850
+ <a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link">CWE-297</a>
851
+ <span class="cwe-name-inline">— Improper Validation of Certificate with Host Mismatch</span>
852
+ </li><li>
853
+ <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link">CWE-295</a>
854
+ <span class="cwe-name-inline">— Improper Certificate Validation</span>
855
+ </li></ul></div>
856
+ </div><div class="panel-block">
857
+ <div class="panel-title">Metadata</div>
858
+ <div><div class="kv"><div><label>CVSS:V40</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 52.8/100</span></div><div><label>EPSS</label><span>0.0% prob · 12th pct</span></div><div><label>Fix version</label><span>2.25.4</span></div><div><label>Published</label><span>2026-04-10</span></div><div><label>Modified</label><span>2026-05-06</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
859
+ </div><div class="panel-block">
860
+ <div class="panel-title">External links <span class="count">(5)</span></div>
861
+ <div><div class="ref-group">
862
+ <span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
863
+ <ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4075" target="_blank">https://github.com/apache/logging-log4j2/pull/4075</a></li></ul>
864
+ </div><div class="ref-group">
865
+ <span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">2 links</span>
866
+ <ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li><li><a href="https://logging.apache.org/security.html#CVE-2026-34477" target="_blank">https://logging.apache.org/security.html#CVE-2026-34477</a></li></ul>
867
+ </div><div class="ref-group">
868
+ <span class="ref-label mailing">Mailing list</span><span style="color:#9ca3af;font-size:11px">1 link</span>
869
+ <ul class="ref-list"><li><a href="https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4" target="_blank">https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4</a></li></ul>
870
+ </div><div class="ref-group">
871
+ <span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">1 link</span>
872
+ <ul class="ref-list"><li><a href="https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName</a></li></ul>
873
+ </div></div>
874
+ </div><div class="panel-block">
875
+ <div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
876
+ <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
877
+ </div><div class="panel-block">
878
+ <div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
879
+ <div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
880
+ </div></div></td></tr></tbody>
881
+ </table></div>
882
+ </details><details class="report-subsection" open>
883
+ <summary><h3><code class="path">services/worker/pom.xml</code> (3)</h3></summary>
884
+ <div><table border="1" cellspacing="0" cellpadding="4" width="100%" style="width:100%;border-collapse:collapse;table-layout:fixed"><colgroup><col style="width:9%"><col style="width:7%"><col style="width:9%"><col style="width:14%"><col style="width:9%"><col style="width:6%"><col style="width:22%"><col style="width:10%"><col style="width:14%"></colgroup><thead><tr><th>Priority</th><th>Severity</th><th>CVE ID</th><th>Dependency</th><th>CWE</th><th>Published</th><th>Description</th><th>Fix Version</th><th>Source</th></tr></thead>
449
885
  <tbody><tr class="cve-row open">
450
886
  <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span></td>
451
887
  <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
452
888
  <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2025-68161" target="_blank">CVE-2025-68161</a><div class="confidence">exact</div></td>
453
- <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>dist/app.jar!/BOOT-INF/lib/log4j-core-2.14.0.jar</code></div></td>
454
- <td class="cwe"><span class="cwe-empty">—</span></td>
455
- <td class="published">—</td>
889
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
890
+ <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
891
+ <td class="published">2025-12-18</td>
456
892
  <td class="desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#…</td>
457
893
  <td class="dep">2.25.3</td>
458
- <td><span class="source fad">fad</span></td>
894
+ <td><span class="source fad">fad</span><span class="source nvd">nvd</span></td>
459
895
 
460
896
  </tr>
461
897
  <tr class="detail-row open"><td colspan="9"><div class="detail-panel"><div class="panel-block">
462
898
  <div class="panel-title">Description</div>
463
- <div><div class="full-desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html…</div></div>
899
+ <div><div class="full-desc">The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true.
900
+
901
+ This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:
902
+
903
+ * The attacker is able to intercept or redirect network traffic between the client and the log receiver.
904
+ * The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).
905
+
906
+
907
+ Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.
908
+
909
+ As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.</div></div>
910
+ </div><div class="panel-block">
911
+ <div class="panel-title">Weaknesses (CWE) <span class="count">(2)</span></div>
912
+ <div><ul class="cwe-list"><li>
913
+ <a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link">CWE-297</a>
914
+ <span class="cwe-name-inline">— Improper Validation of Certificate with Host Mismatch</span>
915
+ </li><li>
916
+ <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link">CWE-295</a>
917
+ <span class="cwe-name-inline">— Improper Certificate Validation</span>
918
+ </li></ul></div>
464
919
  </div><div class="panel-block">
465
920
  <div class="panel-title">Metadata</div>
466
- <div><div class="kv"><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 63/100</span></div><div><label>Fix version</label><span>2.25.3</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad</span></div></div></div>
921
+ <div><div class="kv"><div><label>CVSS:4.0</label><span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span></div><div><label>Base score</label><span>6.3 (MEDIUM)</span></div><div><label>Priority</label><span>MEDIUM · 63/100</span></div><div><label>Fix version</label><span>2.25.3</span></div><div><label>Published</label><span>2025-12-18</span></div><div><label>Modified</label><span>2026-01-20</span></div><div><label>Match confidence</label><span>exact</span></div><div><label>Sources</label><span>fad+nvd</span></div></div></div>
922
+ </div><div class="panel-block">
923
+ <div class="panel-title">External links <span class="count">(8)</span></div>
924
+ <div><div class="ref-group">
925
+ <span class="ref-label patch">Patch / Commit</span><span style="color:#9ca3af;font-size:11px">1 link</span>
926
+ <ul class="ref-list"><li><a href="https://github.com/apache/logging-log4j2/pull/4002" target="_blank">https://github.com/apache/logging-log4j2/pull/4002</a></li></ul>
927
+ </div><div class="ref-group">
928
+ <span class="ref-label exploit">Exploit / PoC</span><span style="color:#9ca3af;font-size:11px">1 link</span>
929
+ <ul class="ref-list"><li><a href="https://logging.apache.org/security.html#CVE-2025-68161" target="_blank">https://logging.apache.org/security.html#CVE-2025-68161</a></li></ul>
930
+ </div><div class="ref-group">
931
+ <span class="ref-label vendor">Vendor advisory</span><span style="color:#9ca3af;font-size:11px">1 link</span>
932
+ <ul class="ref-list"><li><a href="https://logging.apache.org/cyclonedx/vdr.xml" target="_blank">https://logging.apache.org/cyclonedx/vdr.xml</a></li></ul>
933
+ </div><div class="ref-group">
934
+ <span class="ref-label mailing">Mailing list</span><span style="color:#9ca3af;font-size:11px">3 links</span>
935
+ <ul class="ref-list"><li><a href="https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx" target="_blank">https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx</a></li><li><a href="http://www.openwall.com/lists/oss-security/2025/12/18/1" target="_blank">http://www.openwall.com/lists/oss-security/2025/12/18/1</a></li><li><a href="https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html" target="_blank">https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html</a></li></ul>
936
+ </div><div class="ref-group">
937
+ <span class="ref-label web">Other</span><span style="color:#9ca3af;font-size:11px">2 links</span>
938
+ <ul class="ref-list"><li><a href="https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName</a></li><li><a href="https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName" target="_blank">https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName</a></li></ul>
939
+ </div></div>
940
+ </div><div class="panel-block">
941
+ <div class="panel-title">Affected CPE configurations <span class="count">(6)</span></div>
942
+ <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc1-rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:*</li></ul></div>
467
943
  </div><div class="panel-block">
468
- <div class="panel-title">Declared in <span class="count">(1 POM)</span></div>
469
- <div><div class="via-list"><div>dist/app.jar!/BOOT-INF/lib/log4j-core-2.14.0.jar</div></div></div>
944
+ <div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
945
+ <div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
470
946
  </div></div></td></tr>
471
947
  <tr class="cve-row open">
472
948
  <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 11%</div></td>
473
949
  <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.9</div></td>
474
950
  <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34480" target="_blank">CVE-2026-34480</a><div class="confidence">exact</div></td>
475
- <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>dist/app.jar!/BOOT-INF/lib/log4j-core-2.14.0.jar</code></div></td>
951
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
476
952
  <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/116.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-116: Improper Encoding or Escaping of Output">CWE-116</a><div class="cwe-name">Improper Encoding or Escaping of Output</div></td>
477
953
  <td class="published">2026-04-10</td>
478
954
  <td class="desc">Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#char…</td>
@@ -519,14 +995,14 @@ Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this is
519
995
  <div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
520
996
  <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
521
997
  </div><div class="panel-block">
522
- <div class="panel-title">Declared in <span class="count">(1 POM)</span></div>
523
- <div><div class="via-list"><div>dist/app.jar!/BOOT-INF/lib/log4j-core-2.14.0.jar</div></div></div>
998
+ <div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
999
+ <div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
524
1000
  </div></div></td></tr>
525
1001
  <tr class="cve-row open">
526
1002
  <td class="prio"><span class="prio-band" style="display:inline-block;padding:2px 7px;border-radius:3px;background:#ca8a04;color:#fff;font-weight:700;font-size:10px;letter-spacing:.4px">MEDIUM</span><div class="epss-chip" title="EPSS score 0.0%">EPSS 12%</div></td>
527
1003
  <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span><div class="confidence">6.3</div></td>
528
1004
  <td class="cve"><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-34477" target="_blank">CVE-2026-34477</a><div class="confidence">exact</div></td>
529
- <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>dist/app.jar!/BOOT-INF/lib/log4j-core-2.14.0.jar</code></div></td>
1005
+ <td class="dep">org.apache.logging.log4j:<br>log4j-core<br><span style="color:#6b7280">2.14.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
530
1006
  <td class="cwe"><a href="https://cwe.mitre.org/data/definitions/297.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-297: Improper Validation of Certificate with Host Mismatch">CWE-297</a><div class="cwe-name">Improper Validation of Certificate with Host Mismatch</div> <a href="https://cwe.mitre.org/data/definitions/295.html" target="_blank" rel="noopener" class="cwe-link" title="CWE-295: Improper Certificate Validation">CWE-295</a><div class="cwe-name">Improper Certificate Validation</div></td>
531
1007
  <td class="published">2026-04-10</td>
532
1008
  <td class="desc">The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systempr…</td>
@@ -579,11 +1055,15 @@ Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this is
579
1055
  <div class="panel-title">Affected CPE configurations <span class="count">(7)</span></div>
580
1056
  <div><ul class="ref-list"><li>cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*</li><li>cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*</li></ul></div>
581
1057
  </div><div class="panel-block">
582
- <div class="panel-title">Declared in <span class="count">(1 POM)</span></div>
583
- <div><div class="via-list"><div>dist/app.jar!/BOOT-INF/lib/log4j-core-2.14.0.jar</div></div></div>
1058
+ <div class="panel-title">Declared in <span class="count">(3 POMs)</span></div>
1059
+ <div><div class="via-list"><div>pom.xml</div><div>services/worker/pom.xml</div><div>libs/common-bom/pom.xml</div></div></div>
584
1060
  </div></div></td></tr></tbody>
585
- </table></div></div>
1061
+ </table></div>
1062
+ </details></div>
1063
+ </details></div>
1064
+ </details></div>
586
1065
  </details>
1066
+
587
1067
  <details class="report-section" id="ch2" open>
588
1068
  <summary><h2>2. Vendored JS scan — retire.js (0)</h2></summary>
589
1069
  <div><div class="empty">No vulnerable vendored JavaScript files detected (or retire.js was skipped).</div></div>
@@ -593,20 +1073,78 @@ Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this is
593
1073
  <div><div class="empty">No CVE matches.</div></div>
594
1074
  </details>
595
1075
  <details class="report-section" open id="ch4">
596
- <summary><h2>4. End-of-Life Frameworks (0)</h2></summary>
597
- <div><div class="empty">No end-of-life frameworks detected.</div></div>
1076
+ <summary><h2>4. End-of-Life Frameworks (1)</h2></summary>
1077
+ <div><table border="1" cellspacing="0" cellpadding="4" width="100%" style="width:100%;border-collapse:collapse;table-layout:fixed"><colgroup><col style="width:15%"><col style="width:25%"><col style="width:12%"><col style="width:12%"><col style="width:36%"></colgroup><thead><tr><th>Product</th><th>Dependency</th><th>EOL date</th><th>Latest</th><th>Notes</th></tr></thead>
1078
+ <tbody><tr>
1079
+ <td class="dep">Spring Framework</td>
1080
+ <td class="dep">org.springframework:spring-web<br><span style="color:#6b7280">5.3.20</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>services/api/pom.xml</code></div></td>
1081
+ <td>2024-08-31</td>
1082
+ <td>5.3.39</td>
1083
+ <td class="desc">Latest: 5.3.39 (2024-08-14)</td>
1084
+ </tr></tbody>
1085
+ </table></div>
598
1086
  </details>
599
1087
  <details class="report-section" open id="ch5">
600
- <summary><h2>5. Obsolete / Deprecated Libraries (0)</h2></summary>
601
- <div><div class="empty">No obsolete / deprecated libraries detected.</div></div>
1088
+ <summary><h2>5. Obsolete / Deprecated Libraries (1)</h2></summary>
1089
+ <div><table border="1" cellspacing="0" cellpadding="4" width="100%" style="width:100%;border-collapse:collapse;table-layout:fixed"><colgroup><col style="width:10%"><col style="width:25%"><col style="width:25%"><col style="width:40%"></colgroup><thead><tr><th>Severity</th><th>Obsolete</th><th>Replacement</th><th>Why</th></tr></thead>
1090
+ <tbody><tr>
1091
+ <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#3b82f6;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">LOW</span></td>
1092
+ <td class="dep">junit:junit<br><span style="color:#6b7280">4.12</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>services/worker/pom.xml</code></div></td>
1093
+ <td class="dep">org.junit.jupiter:junit-jupiter (JUnit 5)</td>
1094
+ <td class="desc">JUnit 4 is in maintenance; JUnit 5 is the modern line.</td>
1095
+ </tr></tbody>
1096
+ </table></div>
602
1097
  </details>
603
1098
  <details class="report-section" open id="ch6">
604
- <summary><h2>6. Outdated Libraries (0)</h2></summary>
605
- <div><div class="empty">No outdated libraries (or --allLibs not set).</div></div>
1099
+ <summary><h2>6. Outdated Libraries (5)</h2></summary>
1100
+ <div><table border="1" cellspacing="0" cellpadding="4" width="100%" style="width:100%;border-collapse:collapse;table-layout:fixed"><colgroup><col style="width:12%"><col style="width:38%"><col style="width:18%"><col style="width:18%"><col style="width:14%"></colgroup><thead><tr><th>Jump</th><th>Dependency</th><th>Current</th><th>Latest</th><th>Released</th></tr></thead>
1101
+ <tbody><tr class="jump-major">
1102
+ <td><span class="jump-badge jump-major">+1 major</span></td>
1103
+ <td class="dep">npm:chalk<div class="defined-in"><span class="defined-label">defined in:</span> <code>packages/cli/yarn.lock</code></div></td>
1104
+ <td class="dep">4.1.2</td>
1105
+ <td class="dep">5.6.2</td>
1106
+ <td>2025-09-08</td>
1107
+ </tr>
1108
+ <tr class="jump-major">
1109
+ <td><span class="jump-badge jump-major">+3 major</span></td>
1110
+ <td class="dep">npm:supports-color<div class="defined-in"><span class="defined-label">defined in:</span> <code>packages/cli/yarn.lock</code></div></td>
1111
+ <td class="dep">7.2.0</td>
1112
+ <td class="dep">10.2.2</td>
1113
+ <td>2025-09-08</td>
1114
+ </tr>
1115
+ <tr class="jump-major">
1116
+ <td><span class="jump-badge jump-major">+1 major</span></td>
1117
+ <td class="dep">org.yaml:snakeyaml<div class="defined-in"><span class="defined-label">defined in:</span> <code>services/worker/pom.xml</code></div></td>
1118
+ <td class="dep">1.30</td>
1119
+ <td class="dep">2.4</td>
1120
+ <td>2025-02-15</td>
1121
+ </tr>
1122
+ <tr class="jump-minor">
1123
+ <td><span class="jump-badge jump-minor">+9 minor</span></td>
1124
+ <td class="dep">com.fasterxml.jackson.core:jackson-databind<div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/api/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
1125
+ <td class="dep">2.9.10</td>
1126
+ <td class="dep">2.18.4</td>
1127
+ <td>2025-05-07</td>
1128
+ </tr>
1129
+ <tr class="jump-minor">
1130
+ <td><span class="jump-badge jump-minor">+12 minor</span></td>
1131
+ <td class="dep">org.apache.logging.log4j:log4j-core<div class="defined-in"><span class="defined-label">defined in:</span> <code>pom.xml</code>, <code>services/worker/pom.xml</code>, <code>libs/common-bom/pom.xml</code></div></td>
1132
+ <td class="dep">2.14.0</td>
1133
+ <td class="dep">2.26.0</td>
1134
+ <td>2026-05-02</td>
1135
+ </tr></tbody>
1136
+ </table></div>
606
1137
  </details>
607
1138
  <details class="report-section" id="ch7" open>
608
- <summary><h2>7. Licenses (0)</h2></summary>
609
- <div><div class="empty">No license data resolved (offline, or registries returned none).</div></div>
1139
+ <summary><h2>7. Licenses (1)</h2></summary>
1140
+ <div><div class="fp-intro">All resolved licenses are permissive. Listed for completeness.</div><div class="lic-group lic-ok">
1141
+ <h3 class="lic-h">Permissive (MIT/Apache/BSD) <span class="lic-n">1</span></h3>
1142
+ <table border="1" cellspacing="0" cellpadding="4" width="100%" style="width:100%;border-collapse:collapse;table-layout:fixed"><thead><tr><th>Dependency</th><th>License(s)</th><th>Source</th></tr></thead><tbody><tr>
1143
+ <td><td class="dep">npm:<br>supports-color<br><span style="color:#6b7280">7.2.0</span> <span class="chip direct">direct</span><div class="defined-in"><span class="defined-label">defined in:</span> <code>packages/cli/yarn.lock</code></div></td></td>
1144
+ <td>MIT</td>
1145
+ <td>npm</td>
1146
+ </tr></tbody></table>
1147
+ </div></div>
610
1148
  </details>
611
1149
  <details class="report-section" id="ch8" open>
612
1150
  <summary><h2>8. Fix Recommendations</h2></summary>
@@ -616,11 +1154,11 @@ Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this is
616
1154
  <thead><tr><th>Worst sev</th><th>Direct dependency</th><th>Current</th><th>Pin to ≥</th><th>Maven Central latest</th><th>CVEs covered</th></tr></thead>
617
1155
  <tbody><tr>
618
1156
  <td><span style="display:inline-block;padding:2px 8px;border-radius:3px;background:#f08c00;color:#fff;font-weight:600;font-size:11px;letter-spacing:.5px">MEDIUM</span></td>
619
- <td class="dep">com.google.guava:guava</td>
620
- <td class="dep">30.0-jre</td>
621
- <td class="dep"><span style="color:#065f46;font-weight:600">32.0.0</span></td>
622
- <td class="dep"><span style="color:#9ca3af">—</span></td>
623
- <td class="confidence">2 CVE: CVE-2023-2976, CVE-2020-8908</td>
1157
+ <td class="dep">org.apache.logging.log4j:log4j-core</td>
1158
+ <td class="dep">2.14.0</td>
1159
+ <td class="dep"><span style="color:#065f46;font-weight:600">2.25.4</span></td>
1160
+ <td class="dep">2.26.0</td>
1161
+ <td class="confidence">3 CVE: CVE-2025-68161, CVE-2026-34477, CVE-2026-34480</td>
624
1162
  </tr></tbody>
625
1163
  </table></div>
626
1164
  </details></div>