GHSA-4f7c-pmjv-c25w

Source

https://github.com/advisories/GHSA-4f7c-pmjv-c25w

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-4f7c-pmjv-c25w/GHSA-4f7c-pmjv-c25w.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-4f7c-pmjv-c25w

Aliases

CVE-2026-40021

Published

2026-04-10T18:31:18Z

Modified

2026-04-14T01:19:57.266742Z

Severity

6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N CVSS Calculator

Summary

Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters

Details

Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event.

An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.

Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue.

Database specific

{
    "severity": "MODERATE",
    "cwe_ids": [
        "CWE-116"
    ],
    "nvd_published_at": "2026-04-10T16:16:32Z",
    "github_reviewed_at": "2026-04-14T01:02:41Z",
    "github_reviewed": true
}

References

Affected packages

NuGet / log4net

Package

Name: log4net; View open source insights on deps.dev
Purl: pkg:nuget/log4net

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.3.0

Affected versions

1.*

1.2.10

1.2.11

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

2.0.10

2.0.11

2.0.12

2.0.13

2.0.14

2.0.15

2.0.16

2.0.17

3.*

3.0.0

3.0.1

3.0.2

3.0.3

3.0.4

3.1.0

3.2.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-4f7c-pmjv-c25w/GHSA-4f7c-pmjv-c25w.json"