PatchTheCVElog4net vulnerabilities and fixes
Recent CVEs affecting log4net, with upgrade or downgrade steps. 6 tracked.
log4net has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 6. Most recent: 2026-10-06. Highest priority: CVE-2026-105239 (score 43/100).
- CVE-2026-105239 MEDIUM 5.3 UPGRADE Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net.
- CVE-2026-105240 MEDIUM 5.3 UPGRADE Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache
- CVE-2026-105241 MEDIUM 5.3 UPGRADE Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content t
- CVE-2026-105242 MEDIUM 5.3 UPGRADE Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache lo
- CVE-2026-105243 MEDIUM 5.3 UPGRADE Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were truncated to
- CVE-2026-105244 MEDIUM 5.3 UPGRADE Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every ch
FAQ
How do I fix log4net vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is log4net being exploited right now?
None of the tracked log4net CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which log4net CVE should I patch first?
CVE-2026-105239 currently ranks highest (43/100): Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net..