OSV-2026-1528: Heap-use-after-free in log4cxx::helpers::InetAddress::toString
Published Nov 11, 2026
·Updated
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=583622276
Crash type: Heap-use-after-free READ 8 Crash state: log4cxx::helpers::InetAddress::toString log4cxx::net::SocketAppenderSkeleton::SocketAppenderSkeletonPriv::retryConnect log4cxx::helpers::ThreadUtility::privdata::doPeriodicTasks
Affected Software
1 affected component
oss-fuzz/apache-logging-log4cxx
Event History
Nov 11, 2026
Advisory Published
via OSV·12:08 AM
Data Sourced
via OSV·12:08 AM
DescriptionAffected Software
Frequently Asked Questions
1
What execution path is implicated by the crash?
The reported use-after-free occurs in log4cxx::helpers::InetAddress::toString during SocketAppenderSkeletonPriv::retryConnect, invoked from periodic thread tasks.
2
What type of memory-safety issue was observed?
OSS-Fuzz reported an 8-byte heap use-after-free read. The supplied data does not identify affected versions, configurations, exploit prerequisites, or mitigations.