Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-105244

Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache…

Risk score
43/100
CVSS
5.3 v3.1
Exploit chance (30 days)
0.8%
Published
6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log m…
Affected
Apache log4net before 3.5.0
Fix
Upgrade Apache log4net to 3.5.0 or later.
Exploitation
No known exploitation

Story map

Story map: Apache log4netTHE FLAWSTHE FIXCVE-2026-105244Improper Encoding or Escapingof Output vulnerability in theRemoteSyslogAppender of…CVSS 5.3 · EPSS 1%CVE-2026-105239Improper Neutralization ofNull Byte or NUL Charactervulnerability in the…CVSS 5.3 · EPSS 1%CVE-2026-105241Improper Handling of UnicodeEncoding vulnerability in theSmtpPickupDirAppender of…CVSS 5.3 · EPSS 1%CVE-2026-105242Improper Handling ofExceptional Conditionsvulnerability in the…CVSS 5.3 · EPSS 1%Upgrade Apache log4net3.5.0or later on your release lineWho is exposedApache log4net before 3.5.0YELLOW · PLAN IT INApache log4netImproper Encoding or Escapingof Output vulnerability in theRemoteSyslogAppender ofApache log4net. Every characteroutside visible ASCII and spacewas removed from the recordinstead of being escaped, so…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-116 (CWE-116)34 other warnings in 30 days →Same productEarlier Apache log4net warnings2 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Apache log4net: Yellow, plan it in. Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log m…

The flaws

  • CVE-2026-105244: Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache… (CVSS 5.3 · EPSS 1%)
  • CVE-2026-105239: Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of… (CVSS 5.3 · EPSS 1%)
  • CVE-2026-105241: Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache… (CVSS 5.3 · EPSS 1%)
  • CVE-2026-105242: Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter… (CVSS 5.3 · EPSS 1%)

The fix

Upgrade Apache log4net: 3.5.0 or later on your release line

Who is exposed: Apache log4net before 3.5.0

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 5.3 medium

References

Original description

Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected. This issue affects Apache log4net: from 1.2.12 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.

Last activity 6 Oct 2026. Patch Forecast updates every hour.