Description
Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event.
An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.
Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Log4net | < 3.3.0 | 3.3.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | log4net | 1.2.10+dfsg-10 | — |
| Debian 13 | log4net | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | log4net | No fix yet | — |
| Ubuntu 26.04 LTS | log4net | No fix yet | — |
| Ubuntu 25.10 | log4net | No fix yet | — |
| Ubuntu 24.04 LTS | log4net | No fix yet | — |
| Ubuntu 22.04 LTS | log4net | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | log4net | No fix yet | — |
| Ubuntu 18.04 LTS | log4net | No fix yet | — |
| Ubuntu 16.04 LTS | log4net | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| NuGet | log4net | < 3.3.0 | 3.3.0 | GHSA-4f7c-pmjv-c25w |
Advisories 1
- WID-SEC-2026-1054 Apache log4net: Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Apr 14, 2026
References
- https://github.com/apache/logging-log4net/pull/280 patch
- https://logging.apache.org/security.html#CVE-2026-40021 vendor-advisory
- https://logging.apache.org/cyclonedx/vdr.xml vendor-advisory
- https://logging.apache.org/log4net/manual/configuration/layouts.html related
- https://lists.apache.org/thread/q8otftjswhk69n3kxslqg7cobr0x4st7 vendor-advisory