CVE-2026-34478
MediumAdvisory
Published 10 Apr 2026In the index since 6 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.9
- base score, highest
- EPSS
- 0.010
- 60th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 104
- of 17,781 indexed, latest versions
- Container images
- 99
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Apache Log4j Core: log injection in `Rfc5424Layout` due to silent configuration incompatibility
Carried by container images the latest versions of 104 of 17,781 indexed charts deploy, on 99 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| log4j-coremaven | 2.21.0, 2.21.1, 2.22.0, 2.22.1+11 more | 2.25.4 | 99 |
- OSV records
- GHSA-445c-vh5m-36rj
Charts affected
104 by stars
Container images carrying it
99 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| apache/ | 0116fb802786 | log4j-core | 2.25.4 | 2 |
| apache/ | ae0b86d3c4d0 | log4j-core | 2.25.4 | 2 |
| hazelcast/ | 5dd5d31c7a06 | log4j-core | 2.25.4 | 2 |
| hazelcast/ | 991ddb27c251 | log4j-core | 2.25.4 | 2 |
| inaccel/ | 8c53744ed70b | log4j-core | 2.25.4 | 2 |
| library/ | 89729a95066a | log4j-core | 2.25.4 | 2 |
| mbentley/ | f4e682274bed | log4j-core | 2.25.4 | 2 |
| opensearchproject/ | 7f6fa1efee8f | log4j-core | 2.25.4 | 2 |
| ghcr.io/ | 896fc7b18b1b | log4j-core | 2.25.4 | 2 |
| public.ecr.aws/ | d20bd62f0182 | log4j-core | 2.25.4 | 2 |
| 2martens/ | bf1cdb80239d | log4j-core | 2.25.4 | 1 |
| 2martens/ | bd1ba6ab84c9 | log4j-core | 2.25.4 | 1 |
| 2martens/ | ba2c3040dab0 | log4j-core | 2.25.4 | 1 |
| adeptiainc/ | 8607f4f29732 | log4j-core | 2.25.4 | 1 |
| airbyte/ | e1c5e7cfec8a | log4j-core | 2.25.4 | 1 |
| aktosecurity/ | 213aded7adc5 | log4j-core | 2.25.4 | 1 |
| alfio/ | 0c836a081446 | log4j-core | 2.25.4 | 1 |
| alfresco/ | 5472f88d9b0b | log4j-core | 2.25.4 | 1 |
| apache/ | 0305c26f19ed | log4j-core | 2.25.4 | 1 |
| apache/ | bae523439ee3 | log4j-core | 2.25.4 | 1 |
| apache/ | 75d48a62748f | log4j-core | 2.25.4 | 1 |
| apache/ | bff074a5d005 | log4j-core | 2.25.4 | 1 |
| apache/ | ffab324253ed | log4j-core | 2.25.4 | 1 |
| berkeleyskypilot/ | 3bc8bf8f4d83 | log4j-core | 2.25.4 | 1 |
| bitnamilegacy/ | d8440eb6b290 | log4j-core | 2.25.4 | 1 |
| camunda/ | ab5abc09e407 | log4j-core | 2.25.4 | 1 |
| castlemock/ | b7f3f1527ba9 | log4j-core | 2.25.4 | 1 |
| ckan/ | ef8e5d3e6be1 | log4j-core | 2.25.4 | 1 |
| cmosborn/ | 6ec0a8878ad2 | log4j-core | 2.25.4 | 1 |
| conductoross/ | 9fba127693e6 | log4j-core | 2.25.4 | 1 |
| consensys/ | bf6ecd2ea716 | log4j-core | 2.25.4 | 1 |
| folioci/ | eedfcbc29792 | log4j-core | 2.25.4 | 1 |
| folioci/ | 682b852e056d | log4j-core | 2.25.4 | 1 |
| folioci/ | 15ef73b1abd0 | log4j-core | 2.25.4 | 1 |
| folioci/ | 995a25a33133 | log4j-core | 2.25.4 | 1 |
| folioci/ | 3eecd2ac2d8a | log4j-core | 2.25.4 | 1 |
| folioci/ | 68ca414f5596 | log4j-core | 2.25.4 | 1 |
| folioci/ | 0cc86bf09755 | log4j-core | 2.25.4 | 1 |
| folioci/ | f1d7caf4544b | log4j-core | 2.25.4 | 1 |
| folioci/ | 1ad1811c9b37 | log4j-core | 2.25.4 | 1 |
| folioci/ | 3ae8cb99daa3 | log4j-core | 2.25.4 | 1 |
| folioci/ | 79ea8e2e7ebf | log4j-core | 2.25.4 | 1 |
| folioci/ | 15de67587091 | log4j-core | 2.25.4 | 1 |
| folioci/ | fe3a7049f2fb | log4j-core | 2.25.4 | 1 |
| folioci/ | ba84812b4d58 | log4j-core | 2.25.4 | 1 |
| folioci/ | 88de493f86db | log4j-core | 2.25.4 | 1 |
| folioci/ | 5cd5ef063f2a | log4j-core | 2.25.4 | 1 |
| folioci/ | 5f213acfe2f8 | log4j-core | 2.25.4 | 1 |
| folioci/ | de7318069a67 | log4j-core | 2.25.4 | 1 |
| folioci/ | 0a4fa4ad5d72 | log4j-core | 2.25.4 | 1 |