CVE-2026-105244: Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content
Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.
Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.
This issue affects Apache log4net: from 1.2.12 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache log4netto a version that resolves this vulnerability.Fixed in 3.5.0
Event History
Frequently Asked Questions
Which deployments are affected?
Only applications configured to use log4net's RemoteSyslogAppender are affected. Apache log4net versions from 1.2.12 up to, but not including, 3.5.0 are vulnerable.
What does an attacker need to do to exploit this issue?
The attacker needs to cause data they control to be included in a log message that is sent through RemoteSyslogAppender. Non-ASCII characters and control characters, including tabs, can then be removed from the emitted record, making distinct values appear identical.
How can this be mitigated or fixed?
Upgrade Apache log4net to version 3.5.0, which fixes the issue. If upgrading is not immediately possible, avoid using RemoteSyslogAppender for records containing untrusted data.
How can teams identify potentially misleading historical records?
Review RemoteSyslogAppender-generated records for fields where non-ASCII or control characters may have been present in attacker-controlled input. The affected behavior removes those characters without notice, so the stored syslog record may not match the original logged value.