Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Apache Hive and WSO2 AM produce malformed XML logs
published 28 days ago
Summary
The Log4j 1‑to‑2 bridge component used by Apache Hive and WSO2 API Manager can write XML log entries that contain characters not allowed by the XML standard. This can cause log‑processing tools to fail or discard important information. Update to the latest patched version of the bridge or apply the vendor’s recommended configuration change to ensure characters are properly escaped.
What to do
- Update cleanstart apache-hive to version 3.1.3-r3.
- Update cleanstart wso2am to version 4.7.0-r1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| CleanStart | cleanstart | apache-hive |
< 3.1.3-r3 Fix: upgrade to 3.1.3-r3
|
| CleanStart | cleanstart | wso2am |
< 4.7.0-r1 Fix: upgrade to 4.7.0-r1
|
Original advisory text
Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1
CVE-2026-34479 affects multiple packages. The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1. See references for individual vulnerability details.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published8 Oct 2026
Updated8 Oct 2026
First seen8 Oct 2026
Sources
CLEANSTART-2026-RP42469 · OSV
Track software like this
Free during beta