CVE-2006-0743 Apache log4net format string vulnerability causes DoS

What is CVE-2006-0743?

CVE-2006-0743 is a medium-severity memory corruption vulnerability in n/a, published on 9 Mar 2006. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Format string vulnerability in LocalSyslogAppender in Apache log4net 1.2.9 might allow remote attackers to cause a denial of service (memory corruption and termination) via unknown vectors.

Weakness: CWE-134

Which versions are affected by CVE-2006-0743?

2 open source packages ship an affected version, including log4net. It affects 1 product.

Products include Apache Log4net.

How do I fix CVE-2006-0743?

Upgrade log4net to 1.2.10 or later.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2006-0743 being exploited?

There is no known exploitation of CVE-2006-0743 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2018-1285 XML External Entity attack in log4net Critical 9.8
• CVE-2026-40021 Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters Medium 6.3
• CVE-2026-105239 Apache log4net: NUL character truncates EventLogAppender records Medium 5.3
• CVE-2026-105240 Apache log4net: NUL character truncates OutputDebugStringAppender records Medium 5.3
• CVE-2026-105241 Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f9fr-w54q-772h, openSUSE-SU-2024:10072-1.