CVE-2026-105244

Analyzed Analyzed - Analysis Complete

Improper Output Encoding in Apache log4net RemoteSyslogAppender

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: Apache Software Foundation

Description

Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected. This issue affects Apache log4net: from 1.2.12 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105244

EUVD

EUVD-2026-93870

Affected Vendors & Products

Vendor	Product	Version / Range
apache	log4net	From 1.2.12 (inc) to 3.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-116	The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper encoding or escaping of output in the RemoteSyslogAppender of Apache log4net. Instead of properly escaping non-ASCII and control characters, the system removes them from log records. This allows attackers to manipulate log data by inserting invisible characters like zero-width spaces to make values appear identical.

Detection Guidance

Check if your application uses RemoteSyslogAppender in Apache log4net versions before 3.5.0. Inspect log files for missing non-ASCII characters or control characters like tabs that should be present.

Impact Analysis

If your application uses RemoteSyslogAppender in Apache log4net versions before 3.5.0, attackers could manipulate log data to impersonate users or hide malicious activity. For example, a username with a zero-width space could appear as admin in logs, leading to unauthorized actions going unnoticed.

Compliance Impact

This vulnerability could undermine compliance by allowing tampering with audit logs. GDPR requires accurate data logging for accountability, while HIPAA mandates secure and reliable audit trails. Manipulated logs may fail to meet these requirements, risking non-compliance and potential legal consequences.

Mitigation Strategies

Upgrade Apache log4net to version 3.5.0 or later to fix the improper encoding issue in RemoteSyslogAppender.

Hi! I’m here to help you understand CVE-2026-105244. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70