CVE-2026-105244 (GCVE-0-2026-105244)
Vulnerability from cvelistv5
Published
2026-10-06 19:52
Modified
2026-10-07 14:50
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-116 - Improper Encoding or Escaping of Output
Summary
Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.
Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.
This issue affects Apache log4net: from 1.2.12 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Version: 1.2.12 ≤ |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:12:01.025Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/19"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105244",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T14:50:00.691563Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T14:50:49.648Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.12",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "77717061b20d4346b6c0ce6b54643d85fb348bc7",
"status": "affected",
"version": "56a2e146e21ff4737e1ff3ec308810e667873947",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.\u003cbr\u003e\u003cbr\u003eEvery character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.12 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.\n\nEvery character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.12 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:52:31.116Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/315"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/77717061b20d4346b6c0ce6b54643d85fb348bc7"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/q7649hhdodthoqw8jsjgtnb4m8qfy6d6"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105244",
"datePublished": "2026-10-06T19:52:31.116Z",
"dateReserved": "2026-10-04T16:22:18.416Z",
"dateUpdated": "2026-10-07T14:50:49.648Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"cna\": {\"title\": \"Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content\", \"source\": {\"discovery\": \"INTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"The Apache Software Foundation\"}, {\"lang\": \"en\", \"type\": \"tool\", \"value\": \"Claude Security\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Jan Friedrich\"}], \"metrics\": [{\"other\": {\"type\": \"Textual description of severity\", \"content\": {\"text\": \"moderate\"}}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Apache Software Foundation\", \"product\": \"Apache log4net\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.2.12\", \"lessThan\": \"3.5.0\", \"versionType\": \"semver\"}], \"packageURL\": \"pkg:nuget/log4net\", \"packageName\": \"log4net\", \"collectionURL\": \"https://nuget.org/packages\", \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://gitbox.apache.org/repos/asf/logging-log4net.git\", \"vendor\": \"Apache Software Foundation\", \"product\": \"Apache log4net\", \"versions\": [{\"status\": \"affected\", \"version\": \"56a2e146e21ff4737e1ff3ec308810e667873947\", \"lessThan\": \"77717061b20d4346b6c0ce6b54643d85fb348bc7\", \"versionType\": \"git\"}], \"packageURL\": \"pkg:nuget/log4net\", \"packageName\": \"log4net\", \"collectionURL\": \"https://nuget.org/packages\", \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/apache/logging-log4net/pull/315\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/apache/logging-log4net/commit/77717061b20d4346b6c0ce6b54643d85fb348bc7\", \"tags\": [\"patch\"]}, {\"url\": \"https://lists.apache.org/thread.html/q7649hhdodthoqw8jsjgtnb4m8qfy6d6\", \"tags\": [\"vendor-advisory\"]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.3\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.\\n\\nEvery character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.\\n\\nThis issue affects Apache log4net: from 1.2.12 before 3.5.0.\\n\\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.\u003cbr\u003e\u003cbr\u003eEvery character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.12 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue.\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-116\", \"description\": \"CWE-116 Improper Encoding or Escaping of Output\"}]}], \"providerMetadata\": {\"orgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"shortName\": \"apache\", \"dateUpdated\": \"2026-10-06T19:52:31.116Z\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-105244\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-07T14:50:00.691563Z\"}}}], \"providerMetadata\": {\"shortName\": \"CISA-ADP\", \"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"dateUpdated\": \"2026-10-07T14:50:33.564Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2026-105244\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-06T19:52:31.116Z\", \"dateReserved\": \"2026-10-04T16:22:18.416Z\", \"assignerOrgId\": \"f0158376-9dc2-43b6-827c-5f631a4d8d09\", \"datePublished\": \"2026-10-06T19:52:31.116Z\", \"assignerShortName\": \"apache\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…