apache log4net vulnerabilities

Latest apache log4net CVEs

Newest publication first

1. CVE-2026-40021 Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters

   Published 2026-04-10

   Medium·CVSS 6.3

   Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden...

2. CVE-2018-1285 XML External Entity attack in log4net

   Published 2020-05-11

   Critical·CVSS 9.8 EPSS 17.8%

   Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

3. CVE-2006-0743 Apache log4net format string vulnerability causes DoS

   Published 2006-03-09

   Medium·CVSS 5.0

   Format string vulnerability in LocalSyslogAppender in Apache log4net 1.2.9 might allow remote attackers to cause a denial of service (memory corruption and termination) via unknown vectors.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.