CWE-117: Log Injection vulnerabilities

CVE-2026-17377 is a vulnerability in IBM API Connect versions 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2. It allows a remote authenticated attacker to forge audit records due to improper output neutralization for logs, classified under CWE-117. The vulnerability has a medium severity with a CVSS score of 5.0.

CVE-2026-103864 is a vulnerability in Apache Sling Engine prior to version 3.0.4 involving improper output neutralization for logs. This flaw could allow malicious input to be logged without proper sanitization, potentially leading to log injection or manipulation. The issue is fixed in Apache Sling Engine version 3.0.4, and users are advised to upgrade to this version to remediate the vulnerability.

CVE-2026-111211 is a vulnerability in Django versions prior to 6.1.3, 6.0.10, and 5.2.19 where the BaseGeometryWidget.deserialize() method does not properly escape invalid input before logging. This allows remote attackers to inject or forge log entries via crafted geometry values. The issue affects specific Django versions and has been fixed in the stated releases.

CallBackery versions prior to 0.62.0 for Perl have a log injection vulnerability (CWE-117) due to improper neutralization of control characters in login names. The unauthenticated login RPC method allows attackers to inject forged log entries by including newline characters in login names, potentially creating misleading log records such as fake successful administrator logins from arbitrary IP addresses. This vulnerability is fixed in version 0.62.0.

IBM Concert versions 1.0 through 3.0.0 contain a vulnerability where improper output neutralization for logs (CWE-117) allows unauthorized users to inject data into log messages. This could lead to log injection attacks that may affect the integrity of log data. The vulnerability has a medium severity with a CVSS score of 5.3.

CVE-2026-63442 is a vulnerability in the OPNsense core firewall and routing platform prior to version 26.1.11. It involves improper output neutralization for logs, allowing unauthenticated attackers to inject carriage-return and line-feed characters into the WebGUI login username field. This injection manipulates syslog-ng log processing to forge authentication events, enabling attackers to block legitimate IP addresses by adding them to the sshlockout PF table or bypass password-guessing lockout mechanisms. The issue is fixed in version 26.1.11.

CVE-2026-41504 is a CRLF injection vulnerability in the Native audit-log formatter of the Coraza WAF library versions 3.0.0 through 3.7.x. This flaw allows an attacker controlling certain request or response fields to inject carriage return and line feed characters into audit logs, potentially forging lines within transaction records. The vulnerability can mislead operators and disrupt line-oriented SIEM processing. The issue is fixed in version 3.8.0.

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4.

IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.

IBM WebSphere Application Server versions 8.5 and 9.0 have a log injection vulnerability due to improper output neutralization for logs. This issue arises from crafted LTPA token cookies that can manipulate log entries. The vulnerability has a low severity score and does not impact confidentiality or availability but can affect log integrity.

Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters. AshAuthentication.Strategy.Password.RequestPasswordReset.run/3 interpolates the identity argument, the email or username taken straight from the reset request, into its Logger.warning/1 heredocs without escaping, truncating or type-restricting it. The resource logged beside it is passed through inspect/1, which would have neutralized the value. A newline in the identity therefore ends the log record, and everything after it is written as a line of its own, so an attacker chooses the severity tag and the content of entries that appear to have come from the application. This issue affects ash_authentication: from 4.2.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.14.

CVE-2026-84439 is a log injection vulnerability in Apache ZooKeeper affecting versions 3.8.0 through 3.8.6 and 3.9.0 through 3.9.5. When audit logging is enabled, an unauthenticated attacker can inject arbitrary fields into the audit log by sending digest authentication requests with tab characters in the username. This allows the attacker to forge audit log entries, potentially misleading forensic analysis and incident response. The issue is fixed in versions 3.8.7 and 3.9.6.

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters (\n). When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication() logs the raw, unsanitized name via LOG.warn(). Because SLF4J's {} placeholder preserves embedded newlines, the attacker can forge complete log entries — with arbitrary timestamps, log levels, class names, and messages — that are visually indistinguishable from genuine ZooKeeper log output. This issue affects Apache ZooKeeper: from 3.9.0 through 3.9.5, from 3.8.0 through 3.8.6. Users are recommended to upgrade to version 3.8.7 or 3.9.6, which fixes the issue.

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log.

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to inject forged log entries into the server's administrative log.

IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.

IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files.

CVE-2026-54511 is a high-severity vulnerability in the dahlia logtape logging library. Prior to versions 1.3.11, 2.0.14, and 2.1.5, the @logtape/syslog package improperly handles control characters and structured data keys, allowing CRLF injection. This can enable attackers to forge syslog records with arbitrary metadata, undermining log integrity. The issue is fixed in the specified versions.

CVE-2026-59296 is a medium severity vulnerability in Spring Micrometer involving improper output neutralization for logs (CWE-117). It arises from using untrusted, non-normalized input directly in metrics data such as metric names, tag keys, or tag values. This can lead to injection issues affecting the integrity of logs or monitoring data. The affected versions include Micrometer 1.17.0, 1.16.0 through 1.16.6, 1.15.0 through 1.15.12, 1.14.0 through 1.14.16, and 1.9.18 and earlier. No known exploits are reported in the wild, and no official patch or remediation details are provided in the input data.