Apache Log4net
9 CVEs affecting Apache Log4net. Latest disclosed: 2026-10-06. Critical: 1, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2018-1285 | Critical | 9.8 | 2020-05-11 | Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in appli… |
CVE-2026-105244 | Medium | 5.3 | 2026-10-06 | Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was remov… |
CVE-2026-105243 | Medium | 5.3 | 2026-10-06 | Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were truncated to a fixed size that exceeds what the Windows Event… |
CVE-2026-105242 | Medium | 5.3 | 2026-10-06 | Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters triggers ASP.N… |
CVE-2026-105241 | Medium | 5.3 | 2026-10-06 | Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content that the mail file writer cannot encode, such as a… |
CVE-2026-105240 | Medium | 5.3 | 2026-10-06 | Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net. A NUL character in logged content ende… |
CVE-2026-105239 | Medium | 5.3 | 2026-10-06 | Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net. A NUL character in logged content ended the Win… |
CVE-2026-40021 | Medium | 5.3 | 2026-04-10 | Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache… |
CVE-2006-0743 | | 2006-03-09 | Format string vulnerability in LocalSyslogAppender in Apache log4net 1.2.9 might allow remote attackers to cause a denial of service (memory corruption and ter… |