CLEANSTART-2026-BO82472: Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1
Published Nov 13, 2026
·Updated
Security vulnerability affects the spark-sc213-jdk17-py312 package. The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.
Affected Software
1 affected componentFixes available
cleanstart/spark-sc213-jdk17-py312<4.1.4-r0
4.1.4-r0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/spark-sc213-jdk17-py312to a version that resolves this vulnerability.Fixed in 4.1.4-r0
Event History
Nov 13, 2026
Advisory Published
via OSV·12:37 AM
Data Sourced
via OSV·12:37 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What level of attacker access is indicated for exploitation?
The severity vector indicates network-reachable exploitation with low attack complexity. It does not require privileges or user interaction.
2
What is the indicated security impact?
The severity vector indicates high integrity impact, with no confidentiality or availability impact.