TI-2018-01190 CVE-2018-1285 · GHSA-2cwj-8chv-9pp9
XML external entity injection in Apache log4net
Priority MEDIUM 59
Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files.
Apache
Records4054All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical776CVSS 9.0–10.0
CVSS high1543CVSS 7.0–8.9
Exploited now
Apache records in CISA KEVTI-2026-79288 Google Brotli Unchecked Return Value Vulnerability TI-2016-02580 Apache Struts Command Injection Vulnerability TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability
Components
Products in the NVD configurations · select one to filter the recordsRecords
9 records in Log4net · all components
TI-2026-68924 CVE-2026-105244 · GHSA-g956-ph29-3vq5
RemoteSyslogAppender in Apache log4net silently drops non-ASCII text
Priority LOW 32
Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.
TI-2026-68923 CVE-2026-105243 · GHSA-j8mm-w573-8v6c
Apache log4net EventLogAppender silently discards oversize records
Priority LOW 32
Insufficient Logging vulnerability in the EventLogAppender of Apache log4net.
TI-2026-68922 CVE-2026-105242 · GHSA-r886-mf8r-26c7
Log4net drops log events when ASP.NET request validation fails
Priority LOW 32
Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net.
TI-2026-68921 CVE-2026-105241 · GHSA-r5vq-477m-wcfc
Unencodable content drops a whole batch in Apache log4net appender
Priority LOW 32
Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net.
TI-2026-68920 CVE-2026-105240 · GHSA-q2xj-998m-58gf
NUL character truncates log records in Apache log4net debug output
Priority LOW 32
Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net.
TI-2026-68919 CVE-2026-105239 · GHSA-wf3f-44xg-jxj3
NUL character truncates EventLogAppender records in Apache log4net
Priority LOW 32
Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net.
TI-2006-00721 CVE-2006-0743 · GHSA-f9fr-w54q-772h
Format string vulnerability in LocalSyslogAppender in Apache log4net 1.2.9 might allow…
Priority LOW 32
Format string vulnerability in LocalSyslogAppender in Apache log4net 1.2.9 might allow remote attackers to cause a denial of service (memory corruption and termination) via unknown vectors.
TI-2026-28864 CVE-2026-40021 · GHSA-4f7c-pmjv-c25w
Improper output encoding in Apache Log4net
Priority LOW 29
Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in v…