CVE-2026-105244 Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content

Medium 5.3 Published 6 Oct 2026 Updated 7 Oct 2026

Attackers can manipulate log entries by stripping non-ASCII characters, potentially disguising malicious activity in RemoteSyslogAppender logs.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-105244?

CVE-2026-105244 is a medium-severity vulnerability in Apache log4net, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.

Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.

This issue affects Apache log4net: from 1.2.12 before 3.5.0.

Users are recommended to upgrade to version 3.5.0, which fixes the issue.

Weakness: CWE-116

Which versions are affected by CVE-2026-105244?

It affects 1 product.

Products include Apache Log4net.

How do I fix CVE-2026-105244?

No fix has been published for CVE-2026-105244 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-105244 being exploited?

There is no known exploitation of CVE-2026-105244 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-105244, GHSA-g956-ph29-3vq5, UBUNTU-CVE-2026-105244.