Skip to content
OpenAdvisories
Medium WID-SEC-2026-3772 6 CVEs

Apache log4net: Mehrere Schwachstellen ermöglichen Manipulation von Dateien

Published Oct 6, 2026 · Updated Oct 6, 2026 · de-DE

Vendor: Apache Product: log4net

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apache log4net ausnutzen, um Dateien zu manipulieren.

Product

Apache log4net ist eine Logging-Bibliothek für Microsoft .NET-Anwendungen, die es Entwicklern ermöglicht, Protokollausgaben an verschiedene Ziele (Dateien, Datenbanken usw.) auszugeben, ohne die Anwendungsbinärdateien zu ändern.

Vulnerabilities 6

  • Medium 5.3
    CVE-2026-105239

    Apache log4net: NUL character truncates EventLogAppender records

    Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net. A NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception …

    Apache Software Foundation Apache Log4net log4net log4net Debian Ubuntu
  • Medium 5.3
    CVE-2026-105240

    Apache log4net: NUL character truncates OutputDebugStringAppender records

    Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net. A NUL character in logged content ended the debug output record at that point, so everything the layout rendered after it, including except…

    Apache Software Foundation Apache Log4net log4net log4net Debian Ubuntu
  • Medium 5.3
    CVE-2026-105241

    Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch

    Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, n…

    Apache Software Foundation Apache Log4net log4net log4net Debian Ubuntu
  • Medium 5.3
    CVE-2026-105242

    Apache log4net: Request validation failure drops the event in the aspnet-request converter

    Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the app…

    Apache Software Foundation Apache Log4net log4net log4net Debian Ubuntu
  • Medium 5.3
    CVE-2026-105243

    Apache log4net: Oversize EventLogAppender record silently discarded

    Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and rep…

    Apache Software Foundation Apache Log4net log4net log4net Debian Ubuntu
  • Medium 5.3
    CVE-2026-105244

    Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content

    Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs di…

    Apache Software Foundation Apache Log4net log4net log4net Debian Ubuntu

Revision history

  1. #1

    Initiale Fassung

References