CVE-2026-40021 Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters
Attackers can suppress log records by injecting forbidden XML characters, impairing audit trails and detection in applications using Apache Log4net.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-40021?
CVE-2026-40021 is a medium-severity vulnerability in Apache Log4net, published on 10 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event.
An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.
Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue.
Weakness: CWE-116
Which versions are affected by CVE-2026-40021?
2 open source packages ship an affected version, including log4net. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
log4net NuGet | All versions | 3.3.0 |
log4net NuGet | All versions | 3.3.0 |
Products include Apache Log4net.
How do I fix CVE-2026-40021?
Upgrade log4net to 3.3.0 or later.
Is CVE-2026-40021 being exploited?
There is no known exploitation of CVE-2026-40021 in the wild and no public exploit code.
Other vulnerabilities in Apache Log4net
- CVE-2018-1285 XML External Entity attack in log4net
- CVE-2026-105239 Apache log4net: NUL character truncates EventLogAppender records
- CVE-2026-105240 Apache log4net: NUL character truncates OutputDebugStringAppender records
- CVE-2026-105241 Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch
- CVE-2026-105242 Apache log4net: Request validation failure drops the event in the aspnet-request converter
Sources
Also known as DEBIAN-CVE-2026-40021, ECHO-b32c-0992-129e, GHSA-4f7c-pmjv-c25w, UBUNTU-CVE-2026-40021.