CVE-2026-105244
Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.
Does this matter?
Lower severity and a low EPSS score (0.82%). Track it; it rarely justifies an emergency change on its own.
Description
Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected. This issue affects Apache log4net: from 1.2.12 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- EPSS
- 0.82% probability · 57th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-116
- Affected
- apache/log4net
- Source
- security@apache.org
EPSS moved from 0.3% on 7 October 2026 to 0.8% on 26 October 2026.
References
- https://github.com/apache/logging-log4net/commit/77717061b20d4346b6c0ce6b54643d85fb348bc7Patch
- https://github.com/apache/logging-log4net/pull/315Patch, Vendor Advisory
- https://lists.apache.org/thread.html/q7649hhdodthoqw8jsjgtnb4m8qfy6d6Mailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2026/10/07/19Mailing List, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.