Apache Log4net vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

AL

Product

Apache Log4net

by Apache Software Foundation · last CVE Oct 6, 2026

9

CVEs

0

On KEV

9.8

Max CVSS

6

New 30D

Vulnerabilities9 In the news1 Timeline

Severity mix

Critical 1High 0Medium 7Low 0

Severity

All severities9 Critical1 High0 Medium7 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Apache Log4net to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-105244	5.3	1%	Oct 6	Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content Affected: 1.2.12 before 3.5.0
CVE-2026-105243	5.3	1%	Oct 6	Apache log4net: Oversize EventLogAppender record silently discarded Affected: 1.2.9 before 3.5.0
CVE-2026-105242	5.3	1%	Oct 6	Apache log4net: Request validation failure drops the event in the aspnet-request converter Affected: 1.2.11 before 3.5.0
CVE-2026-105241	5.3	1%	Oct 6	Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch Affected: 1.2.9 before 3.5.0
CVE-2026-105240	5.3	1%	Oct 6	Apache log4net: NUL character truncates OutputDebugStringAppender records Affected: 1.2.9 before 3.5.0
CVE-2026-105239	5.3	1%	Oct 6	Apache log4net: NUL character truncates EventLogAppender records Affected: 1.2.9 before 3.5.0
CVE-2026-40021	5.3	1%	Apr 10	Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters Affected: before 3.3.0