Bug 2457315 (CVE-2026-40021) - CVE-2026-40021 log4net: Apache Log4net: Denial of Service for logging via unsanitized XML characters
Summary: CVE-2026-40021 log4net: Apache Log4net: Denial of Service for logging via uns...
Keywords:
Status: NEW
Alias: CVE-2026-40021
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2457916 2457917
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-10 16:01 UTC by OSIDB Bzimport
Modified: 2026-04-13 16:59 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-04-10 16:01:43 UTC 
Apache Log4net's  XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list  and  XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the  XML 1.0 specification https://www.w3.org/TR/xml/#charsets  in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event.

An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.

Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue.
Note You need to log in before you can comment on or make changes to this bug.