What is CVE-2026-40021?

CVE-2026-40021 is a medium-severity vulnerability in Apache Log4net, classified under Improper Encoding or Escaping of Output. CVSS score: 5.3/10. Published 2026-04-10.

How severe is CVE-2026-40021?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Apache Log4net

CVE-2026-40021

Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event. An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue.

Published 2026-04-10 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

EPSS exploit prediction

EPSS: 0.010 (60.8th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 61st percentile — 60.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.007 · newest: 0.010 · change: +0.002

Affected products

Apache Log4net
Apache Software Foundation Log4net — versions 0

Weakness classification (CWE)

CWE-116 — Improper Encoding or Escaping of Output

References

github.com/apache/logging-log4net/pull/280 (patch, Issue Tracking)
logging.apache.org/security.html (vendor-advisory, Vendor Advisory)
logging.apache.org/cyclonedx/vdr.xml (Product, vendor-advisory)
logging.apache.org/log4net/manual/configuration/layouts.html (related, Product)
lists.apache.org/thread/q8otftjswhk69n3kxslqg7cobr0x4st7 (vendor-advisory, Mailing List, Vendor Advisory)
af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)

Frequently asked questions

What is CVE-2026-40021?: CVE-2026-40021 is a medium-severity vulnerability in Apache Log4net, classified under Improper Encoding or Escaping of Output. CVSS score: 5.3/10. Published 2026-04-10.
How severe is CVE-2026-40021?: Medium severity. CVSS v3 base score is 5.3 out of 10.