GHSA-6hg6-v5c8-fphq Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration

• Maven org.apache.logging.log4j:log4j-core: >= 2.12.0, < 2.25.4 → fixed in 2.25.4 • Maven org.apache.logging.log4j:log4j-core: >= 3.0.0-alpha1, <= 3.0.0-beta3 (no fix yet)

The fix for CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the `log4j2.sslVerifyHostName` system property, but not when configured through the `verifyHostName` attribute of the `` element. Although the `verifyHostName` configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value. A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met: • An SMTP, Socket, or Syslog appender is in use. • TLS is configured via a nested element. • The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured. This issue does not affect users of the HTTP appender, which uses a separate `verifyHostname` attribute that was not subject to this bug and verifies host names by default. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.