Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. (CVE-2026-105244)
Description
A vulnerability in Apache log4net's RemoteSyslogAppender causes improper encoding or escaping of output. Non-visible ASCII characters and control characters are removed rather than escaped, allowing distinct input values to appear identical in logs. This affects applications using RemoteSyslogAppender. The issue is fixed in version 3.5.0.
CVSS v3.1
Score 5.3medium
Affected software
pkg:deb/ubuntu/log4net?arch=source&distro=xenialpkg:deb/ubuntu/log4net?arch=source&distro=bionicpkg:deb/ubuntu/log4net?arch=source&distro=focalpkg:deb/ubuntu/log4net?arch=source&distro=jammypkg:deb/ubuntu/log4net?arch=source&distro=noblepkg:deb/ubuntu/log4net?arch=source&distro=stonkingpkg:deb/ubuntu/log4net?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The RemoteSyslogAppender component of Apache log4net versions from 1.2.12 up to but not including 3.5.0 improperly handles output encoding or escaping by removing every character outside visible ASCII and space instead of escaping them. This causes non-ASCII text and control characters such as tabs to disappear without notice in log records. Consequently, distinct input values can appear identical in logs, for example, a username containing a zero-width space could be logged as 'admin'. This vulnerability affects only applications using RemoteSyslogAppender. The issue is resolved in log4net version 3.5.0.
Potential Impact
The vulnerability can cause log records to lose important distinguishing characters, potentially misleading log analysis or auditing. It does not impact confidentiality or availability but can affect the integrity of log data by making distinct inputs appear identical. This could hinder forensic investigations or detection of malicious activity relying on log data.
Mitigation Recommendations
Users should upgrade Apache log4net to version 3.5.0 or later, where this issue is fixed. No other mitigations are indicated or required.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-105244
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:16.04:LTS","Ubuntu:18.04:LTS","Ubuntu:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad3f4f22cdf04f6566575e0
Added to database: 10/17/2026, 22:21:38 UTC
Last enriched: 10/17/2026, 22:40:11 UTC
Last updated: 10/17/2026, 22:40:11 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.