Description
Format string vulnerability in LocalSyslogAppender in Apache log4net 1.2.9 might allow remote attackers to cause a denial of service (memory corruption and termination) via unknown vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | log4net | 1.2.10-75.6 | openSUSE-SU-2024:10072-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | log4net | < 1.2.10 | 1.2.10 | GHSA-f9fr-w54q-772h |
Advisories 2
- openSUSE-SU-2024:10072-1 log4net-1.2.10-75.6 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ICSA-24-226-02 Rockwell Automation AADvance Standalone OPC-DA Server CISA ICS & IT advisories · Aug 13, 2024
References
- 22932 third-party-advisory
- ADV-2006-0955 vdb-entry
- 19241 third-party-advisory
- SUSE-SR:2006:026 vendor-advisory
- http://issues.apache.org/jira/browse/LOG4NET-67
- 23905 vdb-entry
- log4net-localsyslogappender-dos(25196) vdb-entry
- 17095 vdb-entry