CVE-2026-105244

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-105244
Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected. This issue affects Apache log4net: from 1.2.12 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/apache/logging-log4net/commit/77717061b20d4346b6c0ce6b54643d85fb348bc7 Patch
https://github.com/apache/logging-log4net/pull/315 Patch Vendor Advisory
https://lists.apache.org/thread.html/q7649hhdodthoqw8jsjgtnb4m8qfy6d6 Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/10/07/19 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:log4net:*:*:*:*:*:*:*:*
History

09 Oct 2026, 15:18

Type Values Removed Values Added
References () https://github.com/apache/logging-log4net/commit/77717061b20d4346b6c0ce6b54643d85fb348bc7 - () https://github.com/apache/logging-log4net/commit/77717061b20d4346b6c0ce6b54643d85fb348bc7 - Patch
References () https://github.com/apache/logging-log4net/pull/315 - () https://github.com/apache/logging-log4net/pull/315 - Patch, Vendor Advisory
References () https://lists.apache.org/thread.html/q7649hhdodthoqw8jsjgtnb4m8qfy6d6 - () https://lists.apache.org/thread.html/q7649hhdodthoqw8jsjgtnb4m8qfy6d6 - Mailing List, Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2026/10/07/19 - () http://www.openwall.com/lists/oss-security/2026/10/07/19 - Mailing List, Third Party Advisory
First Time Apache log4net
Apache
CPE cpe:2.3:a:apache:log4net:*:*:*:*:*:*:*:*

07 Oct 2026, 07:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/10/07/19 -

06 Oct 2026, 20:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-10-06 20:17

Updated : 2026-10-09 15:18

NVD link : CVE-2026-105244

Mitre link : CVE-2026-105244

CVE.ORG link : CVE-2026-105244

JSON object : View

Products Affected

apache

  • log4net
CWE
CWE-116

Improper Encoding or Escaping of Output