Log4net (Apache) - vulnerabilities (CVEs)

9 CVEs, 6 in the last 30 days, 59 known versions, newest CVE from 2026-10-06. Vendor: Apache.

CVEs of Log4net

• CVE-2026-105244 - CVSS 5.3 (medium), 2026-10-06: Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was…
• CVE-2026-105243 - CVSS 5.3 (medium), 2026-10-06: Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were truncated to a fixed size that exceeds what the Windows Event…
• CVE-2026-105242 - CVSS 5.3 (medium), 2026-10-06: Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters triggers…
• CVE-2026-105241 - CVSS 5.3 (medium), 2026-10-06: Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content that the mail file writer cannot encode, such as…
• CVE-2026-105240 - CVSS 5.3 (medium), 2026-10-06: Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net. A NUL character in logged content…
• CVE-2026-105239 - CVSS 5.3 (medium), 2026-10-06: Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net. A NUL character in logged content ended the…
• CVE-2026-40021 - CVSS 6.3 (medium), 2026-04-10: Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J…
• CVE-2018-1285 - CVSS 9.8 (critical), 2020-05-11: Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in…
• CVE-2006-0743 - CVSS 5 (medium), 2006-03-09: Format string vulnerability in LocalSyslogAppender in Apache log4net 1.2.9 might allow remote attackers to cause a denial of service (memory corruption and…