CVE-2026-22041 loggingredactor converts non-string types to string types in logs
An attacker can cause application crashes by triggering type errors in log formatting when non-string data is incorrectly converted to strings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-22041?
CVE-2026-22041 is a low-severity vulnerability in armurox loggingredactor, published on 8 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to version 0.0.6, non-string types are converted into string types, leading to type errors in %d conversions. The problem has been patched in version 0.0.6. No known workarounds are available.
Weakness: CWE-704
Which versions are affected by CVE-2026-22041?
3 open source packages ship an affected version, including loggingredactor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
loggingredactor PyPI | All versions | 0.0.6 |
loggingredactor PyPI | All versions | 0.0.6 |
loggingredactor PyPI | All versions | 0.0.6 |
Products include Armurox Logging Redactor.
How do I fix CVE-2026-22041?
Upgrade loggingredactor to 0.0.6 or later.
Is CVE-2026-22041 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-22041 exists.
Sources
Also known as GHSA-rvjx-cfjh-5mc9, PYSEC-2026-1582.