CVE-2026-105244

Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected. This issue affects Apache log4net: from 1.2.12 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.

• CWE-116

• https://github.com/apache/logging-log4net/commit/77717061b20d4346b6c0ce6b54643d85fb348bc7Patch
• https://github.com/apache/logging-log4net/pull/315Patch, Vendor Advisory
• https://lists.apache.org/thread.html/q7649hhdodthoqw8jsjgtnb4m8qfy6d6Mailing List, Vendor Advisory
• https://www.openwall.com/lists/oss-security/2026/10/07/19Mailing List, Third Party Advisory

Published

Oct 6, 2026

Last Modified

Oct 9, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-105239Improper Neutralization of Null Byte or NUL Character vulner…5.3
• CVE-2026-10524The CoCart WordPress plugin before 4.9.0 does not validate a…7.5
• CVE-2026-105240Improper Neutralization of Null Byte or NUL Character vulner…5.3
• CVE-2026-105241Improper Handling of Unicode Encoding vulnerability in the S…5.3
• CVE-2026-105242Improper Handling of Exceptional Conditions vulnerability in…5.3
• CVE-2026-105243Insufficient Logging vulnerability in the EventLogAppender o…5.3
• CVE-2026-105245A vulnerability has been found in sgl-project sglang up to 0…3.7
• CVE-2026-105246A vulnerability was found in SourceCodester Online Reviewer …7.3
• CVE-2026-105247A vulnerability was determined in SourceCodester Online Revi…7.3
• CVE-2026-105248A security flaw has been discovered in vgmstream up to r2117…6.3
• CVE-2026-105249A weakness has been identified in vgmstream up to r2117. Thi…4.8
• CVE-2026-10525The NEX-Forms WordPress plugin before 9.2.3 does not saniti…6.1