CVE catalog

CVE-2026-105244

DEBIAN-CVE-2026-105244

Severity: Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Published: Oct 6, 2026, 7:52:31 PM UTC
Updated: Oct 8, 2026, 9:47:25 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.82% · Oct 25, 2026

Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected. This issue affects Apache log4net: from 1.2.12 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	log4net	13	`1.2.10+dfsg-10`	vulnerable
Debian	log4net	13	`1.2.10+dfsg-9`	vulnerable
Debian	log4net	14	`1.2.10+dfsg-10`	vulnerable
Debian	log4net	14	`1.2.10+dfsg-9`	vulnerable
Fedora	log4net	44	`0:3.5.0-1.fc44`	fixed
Fedora	nant	44	`1:0.92-43.fc44`	fixed
Fedora	log4net	43	`0:3.5.0-1.fc43`	fixed
Fedora	nant	43	`1:0.92-43.fc43`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Fedora	log4net	rpm	44	`0:3.5.0-1.fc44`	Not reported	FEDORA-2026-0BF84C3130#CVE-2026-105244	Not reported
Fedora	nant	rpm	44	`1:0.92-43.fc44`	Not reported	FEDORA-2026-0BF84C3130#CVE-2026-105244	Not reported
Fedora	log4net	rpm	43	`0:3.5.0-1.fc43`	Not reported	FEDORA-2026-588BC7E01C#CVE-2026-105244	Not reported
Fedora	nant	rpm	43	`1:0.92-43.fc43`	Not reported	FEDORA-2026-588BC7E01C#CVE-2026-105244	Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

[liblog4net1.2-cil]Affected
Source package: [log4net]
Details (2)
- 1.2.10+dfsg-9 · all · trixie
  Affected
  pypi · log4net · debian · 13
- 1.2.10+dfsg-9 · all · trixie
  Affected
  pypi · log4net · debian · 13
[liblog4net-cil-dev]Affected
Source package: [log4net]
Details (2)
- 1.2.10+dfsg-9 · all · trixie
  Affected
  pypi · log4net · debian · 13
- 1.2.10+dfsg-9 · all · trixie
  Affected
  pypi · log4net · debian · 13

[Fedora 43]

[log4net]Unknown
Source package: [log4net]
Details (2)
- 2.0.8-23.fc43 · aarch64 · 43
  Unknown
  Version impact unknown
  pypi · log4net · fedora · 43
- 2.0.8-23.fc43 · x86_64 · 43
  Unknown
  Version impact unknown
  pypi · log4net · fedora · 43
[log4net-devel]Unknown
Source package: [log4net]
Details (3)
- 2.0.8-23.fc43 · aarch64 · 43
  Unknown
  Version impact unknown
  pypi · log4net · fedora · 43
- 2.0.8-23.fc43 · i686 · 43
  Unknown
  Version impact unknown
  pypi · log4net · fedora · 43
- 2.0.8-23.fc43 · x86_64 · 43
  Unknown
  Version impact unknown
  pypi · log4net · fedora · 43
[nant]Unknown
Source package: [nant]
Details (2)
- 1:0.92-40.fc43 · aarch64 · 43
  Unknown
  Version impact unknown
  pypi · nant · fedora · 43
- 1:0.92-40.fc43 · x86_64 · 43
  Unknown
  Version impact unknown
  pypi · nant · fedora · 43
[nant-devel]Unknown
Source package: [nant]
Details (3)
- 1:0.92-40.fc43 · aarch64 · 43
  Unknown
  Version impact unknown
  pypi · nant · fedora · 43
- 1:0.92-40.fc43 · i686 · 43
  Unknown
  Version impact unknown
  pypi · nant · fedora · 43
- 1:0.92-40.fc43 · x86_64 · 43
  Unknown
  Version impact unknown
  pypi · nant · fedora · 43
[nant-docs]Unknown
Source package: [nant]
Details (2)
- 1:0.92-40.fc43 · aarch64 · 43
  Unknown
  Version impact unknown
  pypi · nant · fedora · 43
- 1:0.92-40.fc43 · x86_64 · 43
  Unknown
  Version impact unknown
  pypi · nant · fedora · 43

[Fedora 44]

[log4net]Unknown
Source package: [log4net]
Details (2)
- 2.0.8-24.fc44 · aarch64 · 44
  Unknown
  Version impact unknown
  pypi · log4net · fedora · 44
- 2.0.8-24.fc44 · x86_64 · 44
  Unknown
  Version impact unknown
  pypi · log4net · fedora · 44
[log4net-devel]Unknown
Source package: [log4net]
Details (3)
- 2.0.8-24.fc44 · aarch64 · 44
  Unknown
  Version impact unknown
  pypi · log4net · fedora · 44
- 2.0.8-24.fc44 · i686 · 44
  Unknown
  Version impact unknown
  pypi · log4net · fedora · 44
- 2.0.8-24.fc44 · x86_64 · 44
  Unknown
  Version impact unknown
  pypi · log4net · fedora · 44
[nant]Unknown
Source package: [nant]
Details (2)
- 1:0.92-41.fc44 · aarch64 · 44
  Unknown
  Version impact unknown
  pypi · nant · fedora · 44
- 1:0.92-41.fc44 · x86_64 · 44
  Unknown
  Version impact unknown
  pypi · nant · fedora · 44
[nant-devel]Unknown
Source package: [nant]
Details (3)
- 1:0.92-41.fc44 · aarch64 · 44
  Unknown
  Version impact unknown
  pypi · nant · fedora · 44
- 1:0.92-41.fc44 · i686 · 44
  Unknown
  Version impact unknown
  pypi · nant · fedora · 44
- 1:0.92-41.fc44 · x86_64 · 44
  Unknown
  Version impact unknown
  pypi · nant · fedora · 44
[nant-docs]Unknown
Source package: [nant]
Details (2)
- 1:0.92-41.fc44 · aarch64 · 44
  Unknown
  Version impact unknown
  pypi · nant · fedora · 44
- 1:0.92-41.fc44 · x86_64 · 44
  Unknown
  Version impact unknown
  pypi · nant · fedora · 44

Observed: Oct 23, 2026, 8:14:21 PM UTC

References

[FIRST EPSS] · [Fedora security updates (Bodhi)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]