CVE-2026-40021

Katalog CVE

CVSS 5.3 · Medium EPSS 0,98%

Kerentanan Improper Encoding or Escaping of Output pada apache log4net. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event. An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue.

Rincian

Terbit di NVD

10 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-116: Improper Encoding or Escaping of Output

EPSS (30 hari)

0,98% peluang dieksploitasi; lebih tinggi dari 61,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread/q8otftjswhk69n3kxslqg7cobr0x4st7 mailing list · advisory vendor
• https://logging.apache.org/security.html#CVE-2026-40021 advisory vendor
• http://www.openwall.com/lists/oss-security/2026/04/10/11 mailing list · advisory pihak ketiga
• https://github.com/apache/logging-log4net/pull/280 issue tracking
• https://logging.apache.org/cyclonedx/vdr.xml product
• https://logging.apache.org/log4net/manual/configuration/layouts.html product