Hi, Regarding the fix timeline: neither issue is fixed in any Flink version released so far. The required Log4j upgrade (to 2.26.1, which includes the fix) has already landed on the upcoming development line and will be part of the next major Flink release.
On Wed, Sep 9, 2026 at 12:26 PM [email protected] <[email protected]> wrote: > Hello Flink Community, > > I am currently running Apache Flink flink-2.2.1-bin-scala_2.12 in > production > and have identified two CVEs that appear in Flink's dependency > vulnerability > list. I would like to consult the community on two questions: > > 1. Do these CVEs have any impact on a running flink-2.2.1-bin-scala_2.12 > deployment? > 2. Is there a plan to address these vulnerabilities in the next Flink > release, > and if so, when is the next release expected? > > Below is the list of CVEs I have identified: > > > ┌──────────────────────┬───────────────────────────────────────┬──────────────────────────────────────────────────┐ > │ CVE ID │ Affected Component │ > Description │ > > ├──────────────────────┼───────────────────────────────────────┼──────────────────────────────────────────────────┤ > │ CVE-2026-34481 │ Apache Log4j JSON Template Layout │ CVSS > 4.0: 6.3 MEDIUM — JsonTemplateLayout │ > │ │ (log4j-core) │ outputs > non-RFC-8259-compliant JSON when log │ > │ │ │ events > contain non-finite floating-point values │ > │ │ │ (NaN, > Infinity); fixed in Log4j 2.25.4 │ > > ├──────────────────────┼───────────────────────────────────────┼──────────────────────────────────────────────────┤ > │ CVE-2026-34479 │ Apache Log4j 1-to-Log4j 2 Bridge │ CVSS 3.1: > 7.5 HIGH — Log4j1XmlLayout does not │ > │ │ (log4j-1.2-api) │ escape > XML 1.0 forbidden characters, causing │ > │ │ │ > downstream parsers to fail; fixed in │ > │ │ │ Log4j > 2.25.4 │ > > └──────────────────────┴───────────────────────────────────────┴──────────────────────────────────────────────────┘ > > My questions: > > 1. Impact assessment: Do these CVEs affect a running > flink-2.2.1-bin-scala_2.12 deployment? For example: > - Which Log4j version does flink-2.2.1-bin-scala_2.12 depend on? > - Is the Log4j version bundled in Flink 2.2.1 within the affected range > (2.14.0 <= version < 2.25.4 for CVE-2026-34481; > 2.7 <= version < 2.25.4 for CVE-2026-34479)? > - Does Flink use JsonTemplateLayout or Log4j1XmlLayout in its default > logging configuration? If not, is the vulnerability still reachable? > - Are there any specific Flink features or components that expose these > Log4j layouts in a way that could be exploited? > > 2. Upgrade roadmap: Is there a plan to update the Log4j dependency to > 2.25.4 or later in the next Flink release? If so: > - Which release will include the fix? > - What is the estimated release timeframe? > > Any guidance or pointers to relevant JIRA issues would be greatly > appreciated. > > Thank you for your time and the great work on Flink. > > Best regards, > Dking > [email protected] > ------------------------------ > > -- Best Regards, Purushottam Sinha शुभकामनाएं पुरूषोत्तम सिन्हा
