Low Severity
Published: Oct 25, 2026
Public disclosure: log injection and record corruption in Apache Log4j - three findings (SD-ID injection, 3.x attribute drift, JSON NaN), live-proven
# Log injection and record corruption in Apache Log4j — three findings
> **Status: publicly disclosed here on 2026-10-23.**
> No CVE has been assigned, and there is no upstream fix on any branch of either the 2.x or the 3.x
> line. **This repository is the disclosure** — the findings have not been reported to the Apache
> Logging Services security team, so nobody upstream knows about them yet. See
> [§12 Disclosure](#12-disclosure).
>
> | | |
> |---|---|
> | **Disclosed** | 2026-10-23, in this repository. Vendor **not** notified — see §12 |
> | **Repository** | <https://github.com/vindeckyy/log4j-log-injection> |
> | **Component** | `org.apache.logging.log4j.core.layout.Rfc5424Layout` (log4j-core) and `org.apache.logging.log4j.layout.template.json` (log4j-layout-template-json) |
> | **Class** | CWE-117 · CWE-93 · CWE-20 · CWE-1188 · CWE-1330 |
> | **Impact** | **Integrity** — forged syslog records with attacker-chosen header fields; audit-trail bypass; corrupted log-stream framing |
> | **Severity** | **High** for the primary finding — see [§1.3](#13-severity-rationale) |
## Findings at a glance
| # | Identifier | One line | Severity | Affected |
|---|---|---|---|---|
| 1 | [`LOG4J-SDID-INJECTION`](#1-summary) | An unescaped RFC 5424 `SD-ID` lets attacker data forge syslog records — on **both** the 2.x and 3.x lines | **High** | All 2.x and 3.x releases tested; every upstream branch |
| 2 | [`LOG4J-RFC5424-ATTR-DRIFT`](#101-log4j-rfc5424-attr-drift) | A 2.x `Rfc5424Layout` configuration silently loses its newline-escaping control on 3.x | Medium–High | 3.0.0-beta2, 3.0.0-beta3, `origin/main` |
| 3 | [`LOG4J-JSON-NONFINITE`](#102-log4j-json-nonfinite) | The CVE-2026-34481 fix was never ported to 3.x, so a JSON layout can emit an invalid `NaN` token | Medium | 3.0.0-beta2, 3.0.0-beta3, `origin/main` |
All three are live-proven against released artifacts, not inferred from source reading. The raw
captures are in [`docs/evidence/`](docs/evidence/).
---
## Table of