Apache Log4cxx prior to version 1.7.0 fails to properly encode or escape characters forbidden by the XML 1.0 specification in its XMLLayout output. This improper encoding leads to invalid XML documents that compliant XML parsers reject, causing downstream log processing systems to potentially drop or fail to index logs containing such characters. An attacker able to control logged content can exploit this to suppress individual log records, thereby impairing audit and detection mechanisms. The vulnerability is identified as CWE-116 (Improper Encoding or Escaping of Output).

The vulnerability can cause log records containing forbidden XML characters to be rejected by XML parsers, resulting in loss or omission of those logs in downstream processing systems. This can impair audit trails and hinder detection of malicious activity. There is no indication of direct system compromise or code execution. No known exploits in the wild have been reported.

Users should upgrade to Apache Log4cxx version 1.7.0, which addresses this issue by properly sanitizing forbidden XML characters in log output. No other official remediation or temporary fixes are documented. Patch status is not explicitly confirmed beyond the recommendation to upgrade; therefore, check the vendor advisory for the latest remediation guidance.