Format string vulnerability in LocalSyslogAppender in Apache log4net 1.2.9 might allow…
Priority LOW 32CWE-134Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Partial
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-134 and the CVSS impact.
Summary
Format string vulnerability in LocalSyslogAppender in Apache log4net 1.2.9 might allow remote attackers to cause a denial of service (memory corruption and termination) via unknown vectors.
Why it matters now
EPSS 0.06371 93rd percentileScored 2026-11-07
Fix Fixed log4net (NuGet): 1.2.10
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | log4net (NuGet) | before 1.2.10 | 1.2.10 | Patch available | GHSA-f9fr-w54q-772h |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- log4net (NuGet) Vendor— Affected before 1.2.10 Fixed in 1.2.10 Patch available GHSA-f9fr-w54q-772h
Remediation
- Fix · GHSA-f9fr-w54q-772h log4net (NuGet) Fixed in 1.2.10 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2006-0743
- 2026-10-03 Alias added: GHSA-f9fr-w54q-772h
References
Other 6
- 23905
- https://github.com/apache/logging-log4net/commit/ea3faab25fe5f1d4dbda9f5da8dcfa6fc3d9e1b8
- https://github.com/apache/logging-log4net
- https://web.archive.org/web/20070114054835/http://www.novell.com/linux/security/advisories/2006_26_sr.html
- https://web.archive.org/web/20140304060609/https://issues.apache.org/jira/browse/LOG4NET-67
- https://web.archive.org/web/20200229022118/http://www.securityfocus.com/bid/17095
More Apache Log4net vulnerabilities
- TI-2018-01190 XML external entity injection in Apache log4net CVSS 3.1CRITICAL 9.8
- TI-2026-68924 RemoteSyslogAppender in Apache log4net silently drops non-ASCII text CVSS 3.1MEDIUM 5.3
- TI-2026-68923 Apache log4net EventLogAppender silently discards oversize records CVSS 3.1MEDIUM 5.3
- TI-2026-68922 Log4net drops log events when ASP.NET request validation fails CVSS 3.1MEDIUM 5.3
- TI-2026-68921 Unencodable content drops a whole batch in Apache log4net appender CVSS 3.1MEDIUM 5.3
- TI-2026-68920 NUL character truncates log records in Apache log4net debug output CVSS 3.1MEDIUM 5.3
Sources
- CVE-2006-0743 · CVE Program
- CVE-2006-0743 · NVD
- FIRST EPSS
- GHSA-f9fr-w54q-772h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences