Vulnerability · Published Apr 10, 2026 · Assigned by apache
CVE-2026-40021Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters
Medium 6.3
In plain English
A medium-severity security flaw in Apache Log4net from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event. An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | log4net | no fix listed | DEBIAN-CVE-2026-40021 |
| Debian:14 | log4net | 1.2.10+dfsg-10 | DEBIAN-CVE-2026-40021 |
| NuGet | log4net | 3.3.0 | GHSA-4f7c-pmjv-c25w |
| Ubuntu:22.04:LTS | log4net | no fix listed | UBUNTU-CVE-2026-40021 |
| Ubuntu:24.04:LTS | log4net | no fix listed | UBUNTU-CVE-2026-40021 |
| Ubuntu:25.10 | log4net | no fix listed | UBUNTU-CVE-2026-40021 |
| Ubuntu:26.04:LTS | log4net | no fix listed | UBUNTU-CVE-2026-40021 |
| Ubuntu:26.10 | log4net | no fix listed | UBUNTU-CVE-2026-40021 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Log4net | 0 – before 3.3.0 |
Weakness: CWE-116 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N
References
- https://github.com/apache/logging-log4net/pull/280 patch
- https://logging.apache.org/security.html#CVE-2026-40021 vendor-advisory
- https://logging.apache.org/cyclonedx/vdr.xml vendor-advisory
- https://logging.apache.org/log4net/manual/configuration/layouts.html related
- https://lists.apache.org/thread/q8otftjswhk69n3kxslqg7cobr0x4st7 vendor-advisory
- http://www.openwall.com/lists/oss-security/2026/04/10/11