CVE-2026-40021

{"id": "CVE-2026-40021", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40021", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-10T17:32:06.208358Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security@apache.org", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"cpes": ["cpe:2.3:a:apache:log4net:*:*:*:*:*:*:*:*"], "vendor": "Apache Software Foundation", "product": "Apache Log4net", "versions": [{"status": "affected", "version": "0", "lessThan": "3.3.0", "versionType": "nuget"}], "packageURL": "pkg:nuget/log4net", "packageName": "log4net", "collectionURL": "https://www.nuget.org/packages", "defaultStatus": "unaffected"}]}], "published": "2026-04-10T16:16:32.420", "references": [{"url": "https://github.com/apache/logging-log4net/pull/280", "tags": ["Issue Tracking"], "source": "security@apache.org"}, {"url": "https://lists.apache.org/thread/q8otftjswhk69n3kxslqg7cobr0x4st7", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "https://logging.apache.org/cyclonedx/vdr.xml", "tags": ["Product"], "source": "security@apache.org"}, {"url": "https://logging.apache.org/log4net/manual/configuration/layouts.html", "tags": ["Product"], "source": "security@apache.org"}, {"url": "https://logging.apache.org/security.html#CVE-2026-40021", "tags": ["Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/04/10/11", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-116"}]}], "descriptions": [{"lang": "en", "value": "Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event.\n\nAn attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.\n\nUsers are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue."}, {"lang": "es", "value": "XmlLayout de Apache Log4net https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list y XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , en versiones anteriores a la 3.3.0, no logran sanear caracteres prohibidos por la especificaci\u00f3n XML 1.0 https://www.w3.org/TR/xml/#charsets en las claves y valores de las propiedades MDC, as\u00ed como en el campo de identidad que puede contener datos influenciados por el atacante. Esto provoca una excepci\u00f3n durante la serializaci\u00f3n y la p\u00e9rdida silenciosa del evento de registro afectado.\n\nUn atacante que pueda influir en cualquiera de estos campos puede explotar esto para suprimir registros de log individuales, perjudicando las pistas de auditor\u00eda y la detecci\u00f3n de actividad maliciosa.\n\nSe aconseja a los usuarios actualizar a Apache Log4net 3.3.0, que corrige este problema."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:log4net:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DCD2F9E8-684B-4B34-B48B-32E8225631F3", "versionEndExcluding": "3.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}