What is CVE-2026-105244?

CVE-2026-105244 is a medium-severity vulnerability in Apache Software Foundation Log4net, classified under Improper Encoding or Escaping of Output. CVSS score: 5.3/10. Published 2026-10-06.

How severe is CVE-2026-105244?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Apache Software Foundation Log4net

CVE-2026-105244

Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected. This issue affects Apache log4net: from 1.2.12 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.

Published 2026-10-06 · last modified 2026-10-07.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Apache Software Foundation Log4net

Weakness classification (CWE)

CWE-116 — Improper Encoding or Escaping of Output

References

Frequently asked questions

What is CVE-2026-105244?: CVE-2026-105244 is a medium-severity vulnerability in Apache Software Foundation Log4net, classified under Improper Encoding or Escaping of Output. CVSS score: 5.3/10. Published 2026-10-06.
How severe is CVE-2026-105244?: Medium severity. CVSS v3 base score is 5.3 out of 10.