Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin.
Only applications that use RemoteSyslogAppender are affected. This issue affects Apache log4net: from 1.2.12 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products 1
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Apache Log4net
cpe:2.3:a:apache:log4net:*:*:*:*:*:*:*:*
|
1.2.12
|
3.5.0
|
References 4
https://github.com/apache/logging-log4net/commit/77717061b20d4346b6c0ce6b54643d…
security@apache.org
https://github.com/apache/logging-log4net/pull/315
security@apache.org
https://lists.apache.org/thread.html/q7649hhdodthoqw8jsjgtnb4m8qfy6d6
security@apache.org
http://www.openwall.com/lists/oss-security/2026/10/07/19
af854a3a-2127-422b-91ae-364da2661108