Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html , in versions before 1.7.0, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in log messages, NDC, and MDC property keys and values, producing invalid XML output. Conforming XML parsers must reject such documents with a fatal error, which may cause downstream log processing systems to drop or fail to index affected records. An attacker who can influence logged data can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4cxx 1.7.0, which fixes this issue.

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-31a8569c4b advisory.

    Update to log4cxx 1.7.0.

    Fixes CVE-2026-40023: XMLLayout did not escape characters forbidden     by the XML 1.0 specification, which could cause conforming XML     parsers to reject the produced document, silently dropping log     records.

    No ABI-relevant changes; liblog4cxx SONAME (%{sover}) is unchanged.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-43767b6007 advisory.

    Update to log4cxx 1.7.0.

    New features: fallback-ref appender attribute, Qt CMake find_package     component, TelnetAppender NonBlocking option.

    Bug fixes: non-ASCII JSON encoding, invalid XML 1.0 characters in XML     output, crash on recursive XML config references, possible UB during     configuration changes, message loss during recursive logging,     ODBCAppender prepared-statement buffer lifetimes.

    No ABI-relevant changes; liblog4cxx SONAME (%{sover}) is unchanged.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20705-1 advisory.

    Changes in log4cxx:

    - update to 1.7.0 (bsc#1261994, CVE-2026-40023):
      * Non-ascii characters incorrectly encoded in JSON output [#615]
      * XML output could contain characters not allowed by the XML 1.0         specification
      * An XML configuration file with recursive references caused         program termination [#605]
      * Possible undefined behavior during a configuration change
      * Message loss when the calculation of a logged value also logs
      * ODBCAppender prepared statement value buffers had incorrect         lifetimes [#581]

    - update to 1.6.0:
      * Configuration ${varname} values can be set programatically prior         to loading a configuration file (see com/foo/config4.cpp) [#520]
      * The current executable's file name and its components are available         for use in a configuration file and the LOG4CXX_CONFIGURATION         environment variable (see log4cxx::spi::Configurator::properties).
        [#520]
      * Console output (Log4cxx internal logging and BasicConfigurator)         use a color per message level by default [#529]
      * New logging macros that defer binary-to-text conversion until         used in AsyncAppender's background thread
      * A simplified way to attach an AsyncAppender to a logger using         a configuration file [#550]

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Apache Log4cxx's XMLLayout https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html     , in versions before 1.7.0, fails to sanitize characters forbidden by the XML 1.0 specification     https://www.w3.org/TR/xml/#charsets in log messages, NDC, and MDC property keys and values, producing     invalid XML output. Conforming XML parsers must reject such documents with a fatal error, which may cause     downstream log processing systems to drop or fail to index affected records. An attacker who can influence     logged data can exploit this to suppress individual log records, impairing audit trails and detection of     malicious activity. Users are advised to upgrade to Apache Log4cxx 1.7.0, which fixes this issue.
    (CVE-2026-40023)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
327713	Fedora 43 : log4cxx (2026-31a8569c4b)	Nessus	Fedora Local Security Checks	medium
326413	Fedora 44 : log4cxx (2026-43767b6007)	Nessus	Fedora Local Security Checks	medium
313699	openSUSE 16 Security Update : log4cxx (openSUSE-SU-2026:20705-1)	Nessus	SuSE Local Security Checks	medium
306018	Linux Distros Unpatched Vulnerability : CVE-2026-40023	Nessus	Misc.	medium

Detections

Analytics

CVE-2026-40023

medium

Tenable Plugins

medium

medium

medium

medium