CVE-2026-105244

Apache log4net’s RemoteSyslogAppender fails to escape output and instead drops every character outside visible ASCII and space, including non-ASCII text and control characters such as tabs, without any indication. A party who can place data into a log message can make two distinct values look the same in the syslog record—for example a user name containing a zero-width space recorded as admin—so log integrity and downstream decisions based on those records can be undermined. There is no confidentiality or availability impact; the issue is low-integrity log tampering via silent deletion rather than injection of new characters. Only applications that use RemoteSyslogAppender and run log4net from 1.2.12 before 3.5.0 are affected. It is not listed in CISA KEV and no public proof-of-concept is known.

What to do: Upgrade Apache log4net to 3.5.0. Until then, confirm whether the application configures RemoteSyslogAppender; if it does, treat remote syslog records of untrusted fields (user names, request data) as potentially missing non-ASCII and control characters, and prefer a different appender or an external encoder that preserves those characters.