LO
Product
Log4net
9
CVEs
0
On KEV
9.8
Max CVSS
6
New 30D
Severity mix
Critical 1High 0Medium 7Low 0
Watch
Add Log4net to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-1285 | 9.8 | May 11 | Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files Affected: before 2.0.10 |
| CVE-2026-105244 | 5.3 | Oct 6 | Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content Affected: 1.2.12 before 3.5.0 |
| CVE-2026-105243 | 5.3 | Oct 6 | Apache log4net: Oversize EventLogAppender record silently discarded Affected: 1.2.9 before 3.5.0 |
| CVE-2026-105242 | 5.3 | Oct 6 | Apache log4net: Request validation failure drops the event in the aspnet-request converter Affected: 1.2.11 before 3.5.0 |
| CVE-2026-105241 | 5.3 | Oct 6 | Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch Affected: 1.2.9 before 3.5.0 |
| CVE-2026-105240 | 5.3 | Oct 6 | Apache log4net: NUL character truncates OutputDebugStringAppender records Affected: 1.2.9 before 3.5.0 |
| CVE-2026-105239 | 5.3 | Oct 6 | Apache log4net: NUL character truncates EventLogAppender records Affected: 1.2.9 before 3.5.0 |
| CVE-2026-40021 | 5.3 | Apr 10 | Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters Affected: before 3.3.0 |
| CVE-2006-0743 | – | Mar 9 | Format string vulnerability in LocalSyslogAppender in Apache log4net 1.2.9 might allow remote attackers to cause a denial of service (memory corruption and termination) via… Affected: 1.2.9_beta |
Showing 9