https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 11:34:16 +0000 https://cve.radiocsirt.org/vuln/cve-2026-40021 <p><strong>Affected:</strong> Apache Software Foundation Apache Log4net</p> <p>Apache Log4net&#39;s XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event.</p> <p>An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.</p> <p>Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue.</p> <p><strong>Affected:</strong> Apache Software Foundation Apache Log4net</p> <p>Apache Log4net&#39;s XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event.</p> <p>An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.</p> <p>Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue.</p> https://cve.radiocsirt.org/vuln/cve-2026-40021