CVE catalog
CVE-2026-40021
Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.
- Severity
- Medium · CVSS 6.3
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.77% · Oct 25, 2026
Update log4net to 3.5.0. Nant is rebuilt (only dependency in Fedora).
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Cpe | log4net | Not reported | 3.3.0 | fixed |
| Debian | log4net | 13 | 1.2.10+dfsg-10 | vulnerable |
| Debian | log4net | 13 | 1.2.10+dfsg-9 | vulnerable |
| Debian | log4net | 14 | 1.2.10+dfsg-9 | vulnerable |
| Debian | log4net | 14 | 1.2.10+dfsg-10 | fixed |
| Fedora | log4net | 44 | 0:3.5.0-1.fc44 | fixed |
| Fedora | nant | 44 | 1:0.92-43.fc44 | fixed |
| Fedora | log4net | 43 | 0:3.5.0-1.fc43 | fixed |
| Fedora | nant | 43 | 1:0.92-43.fc43 | fixed |
| Cpe | log4net | Not reported | 3.3.0 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Cpe | log4net | cpe | Not reported | 3.3.0 | Not reported | Not reported | Not reported |
| Debian | log4net | deb | 14 | 1.2.10+dfsg-10 | Not reported | DEBIAN-CVE-2026-40021 | Not reported |
| Fedora | log4net | rpm | 44 | 0:3.5.0-1.fc44 | Not reported | FEDORA-2026-0BF84C3130#CVE-2026-40021 | Not reported |
| Fedora | nant | rpm | 44 | 1:0.92-43.fc44 | Not reported | FEDORA-2026-0BF84C3130#CVE-2026-40021 | Not reported |
| Fedora | log4net | rpm | 43 | 0:3.5.0-1.fc43 | Not reported | FEDORA-2026-588BC7E01C#CVE-2026-40021 | Not reported |
| Fedora | nant | rpm | 43 | 1:0.92-43.fc43 | Not reported | FEDORA-2026-588BC7E01C#CVE-2026-40021 | Not reported |
| Cpe | log4net | cpe | Not reported | 3.3.0 | Not reported | NVD-CVE-2026-40021 | Not reported |
OpenFactory catalog packages
[Debian 13 (Trixie)]
- [liblog4net1.2-cil]Affected
Source package: [log4net]
Details (2)
1.2.10+dfsg-9· all · trixieAffected
nvd · log4net · debian · 13
1.2.10+dfsg-9· all · trixieAffected
nvd · log4net · debian · 13
- [liblog4net-cil-dev]Affected
Source package: [log4net]
Details (2)
1.2.10+dfsg-9· all · trixieAffected
nvd · log4net · debian · 13
1.2.10+dfsg-9· all · trixieAffected
nvd · log4net · debian · 13
[Fedora 43]
- [log4net]Unknown
Source package: [log4net]
Details (2)
2.0.8-23.fc43· aarch64 · 43Unknown
Version impact unknown
nvd · log4net · fedora · 43
2.0.8-23.fc43· x86_64 · 43Unknown
Version impact unknown
nvd · log4net · fedora · 43
- [log4net-devel]Unknown
Source package: [log4net]
Details (3)
2.0.8-23.fc43· aarch64 · 43Unknown
Version impact unknown
nvd · log4net · fedora · 43
2.0.8-23.fc43· i686 · 43Unknown
Version impact unknown
nvd · log4net · fedora · 43
2.0.8-23.fc43· x86_64 · 43Unknown
Version impact unknown
nvd · log4net · fedora · 43
- [nant]Unknown
Source package: [nant]
Details (2)
1:0.92-40.fc43· aarch64 · 43Unknown
Version impact unknown
nvd · nant · fedora · 43
1:0.92-40.fc43· x86_64 · 43Unknown
Version impact unknown
nvd · nant · fedora · 43
- [nant-devel]Unknown
Source package: [nant]
Details (3)
1:0.92-40.fc43· aarch64 · 43Unknown
Version impact unknown
nvd · nant · fedora · 43
1:0.92-40.fc43· i686 · 43Unknown
Version impact unknown
nvd · nant · fedora · 43
1:0.92-40.fc43· x86_64 · 43Unknown
Version impact unknown
nvd · nant · fedora · 43
- [nant-docs]Unknown
Source package: [nant]
Details (2)
1:0.92-40.fc43· aarch64 · 43Unknown
Version impact unknown
nvd · nant · fedora · 43
1:0.92-40.fc43· x86_64 · 43Unknown
Version impact unknown
nvd · nant · fedora · 43
[Fedora 44]
- [log4net]Unknown
Source package: [log4net]
Details (2)
2.0.8-24.fc44· aarch64 · 44Unknown
Version impact unknown
nvd · log4net · fedora · 44
2.0.8-24.fc44· x86_64 · 44Unknown
Version impact unknown
nvd · log4net · fedora · 44
- [log4net-devel]Unknown
Source package: [log4net]
Details (3)
2.0.8-24.fc44· aarch64 · 44Unknown
Version impact unknown
nvd · log4net · fedora · 44
2.0.8-24.fc44· i686 · 44Unknown
Version impact unknown
nvd · log4net · fedora · 44
2.0.8-24.fc44· x86_64 · 44Unknown
Version impact unknown
nvd · log4net · fedora · 44
- [nant]Unknown
Source package: [nant]
Details (2)
1:0.92-41.fc44· aarch64 · 44Unknown
Version impact unknown
nvd · nant · fedora · 44
1:0.92-41.fc44· x86_64 · 44Unknown
Version impact unknown
nvd · nant · fedora · 44
- [nant-devel]Unknown
Source package: [nant]
Details (3)
1:0.92-41.fc44· aarch64 · 44Unknown
Version impact unknown
nvd · nant · fedora · 44
1:0.92-41.fc44· i686 · 44Unknown
Version impact unknown
nvd · nant · fedora · 44
1:0.92-41.fc44· x86_64 · 44Unknown
Version impact unknown
nvd · nant · fedora · 44
- [nant-docs]Unknown
Source package: [nant]
Details (2)
1:0.92-41.fc44· aarch64 · 44Unknown
Version impact unknown
nvd · nant · fedora · 44
1:0.92-41.fc44· x86_64 · 44Unknown
Version impact unknown
nvd · nant · fedora · 44
Observed:
References
- [http://www.openwall.com/lists/oss-security/2026/04/10/11]
- [https://bodhi.fedoraproject.org/updates/FEDORA-2026-588bc7e01c]
- [https://bugzilla.redhat.com/show_bug.cgi?id=2457917]
- [https://bugzilla.redhat.com/show_bug.cgi?id=2547384]
- [https://bugzilla.redhat.com/show_bug.cgi?id=2547386]
- [https://bugzilla.redhat.com/show_bug.cgi?id=2547388]
- [https://github.com/apache/logging-log4net/pull/280]
- [https://lists.apache.org/thread/q8otftjswhk69n3kxslqg7cobr0x4st7]
- [https://logging.apache.org/cyclonedx/vdr.xml]
- [https://logging.apache.org/log4net/manual/configuration/layouts.html]
- [https://logging.apache.org/security.html#CVE-2026-40021]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-40021]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-40021]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-40021.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1054.json]
[CERT-Bund public advisories] · [FIRST EPSS] · [Fedora security updates (Bodhi)] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]