CVE-2026-34480

[AryaKT]

Hi
I wanted to know even if xmllayout is not configured in log4j configuration, if CVE-2026-34480 is still a finding?

[ramanathan1504]

The issue is only in XmlLayout. If none of your appenders use it, the code with the flaw never runs, so you're not affected. Your scanner flags it from the log4j-core version, though, so upgrading to 2.25.4 is the simplest way to clear it. If you can't upgrade yet, marking it as not affected (code not used) is accurate.

Advisory: https://logging.apache.org/security.html#CVE-2026-34480