From bb0cbdea6c58bf36841576df9313f02c0d041add Mon Sep 17 00:00:00 2001
From: Akanksha-kedia <akedia@visa.com>
Date: Thu, 17 Sep 2026 15:07:57 +0530
Subject: [PATCH] HIVE-30066: Upgrade log4j to 2.26.1 to fix CVE-2026-34481

Bump log4j2.version property in pom.xml and standalone-metastore/pom.xml
from 2.25.4 to 2.26.1.
---
 pom.xml                      | 2 +-
 standalone-metastore/pom.xml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pom.xml b/pom.xml
index 2313c30e5e27..bb4eb0dad7bb 100644
--- a/pom.xml
+++ b/pom.xml
@@ -188,7 +188,7 @@
     <libfb303.version>0.9.3</libfb303.version>
     <!-- Thrift version must be inline with one installed in the CI (Docker image referenced in the Jenkinsfile) -->
     <libthrift.version>0.16.0</libthrift.version>
-    <log4j2.version>2.25.4</log4j2.version>
+    <log4j2.version>2.26.1</log4j2.version>
     <mariadb.version>2.5.0</mariadb.version>
     <mssql.version>6.2.1.jre8</mssql.version>
     <mysql.version>8.2.0</mysql.version>
diff --git a/standalone-metastore/pom.xml b/standalone-metastore/pom.xml
index eaab2bb76ff9..79a54202fd75 100644
--- a/standalone-metastore/pom.xml
+++ b/standalone-metastore/pom.xml
@@ -101,7 +101,7 @@
     <junit.platform.version>1.13.3</junit.platform.version>
     <libfb303.version>0.9.3</libfb303.version>
     <libthrift.version>0.16.0</libthrift.version>
-    <log4j2.version>2.25.4</log4j2.version>
+    <log4j2.version>2.26.1</log4j2.version>
     <mockito-core.version>5.17.0</mockito-core.version>
     <orc.version>2.1.2</orc.version>
     <protobuf.version>3.25.5</protobuf.version>