CVE-2026-105244: falha de média gravidade em Apache log4net
Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content
Publicada em · Atualizada em
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.3%
probabilidade de exploração
0.3%top 75% das CVEs
exploração observada
nãonenhuma fonte reporta
Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.
Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.
This issue affects Apache log4net: from 1.2.12 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
Apache Software Foundation · Apache log4netCVEs relacionadas — Apache log4net
No mesmo produto, das mais perigosas para as menos.
CVE-2026-105242MEDIUMApache log4net: Request validation failure drops the event in the aspnet-request converterEPSS 0.3%CVE-2026-105241MEDIUMApache log4net: Unencodable content discards a whole SmtpPickupDirAppender batchEPSS 0.3%CVE-2026-105239MEDIUMApache log4net: NUL character truncates EventLogAppender recordsEPSS 0.3%CVE-2026-105243MEDIUMApache log4net: Oversize EventLogAppender record silently discardedEPSS 0.3%CVE-2026-105240MEDIUMApache log4net: NUL character truncates OutputDebugStringAppender recordsEPSS 0.3%