Log4j’s “Silent” Security Gap: New Advisories Warn of Data Loss and TLS Bypasses

This advisory details four “silent failure” vulnerabilities in Apache Log4j 2 (affecting XmlLayout, the Log4j 1-to-2 bridge, Rfc5424Layout, and TLS hostname verification) that can produce malformed or dropped logs, enable log injection and CRLF attacks, silently downgrade or remove TLS framing, and ignore hostname verification—exposing systems to log integrity issues and potential MITM; administrators are urged to upgrade to 2.25.4, audit syslog/TLS settings, and remove reliance on the Log4j 1 bridge.