CVE-2026-105244: Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content
AI summary · grok-4.7Summaries by Vani AI
Apache log4net RemoteSyslogAppender strips non-ASCII characters, CVE-2026-105244, CVSS 5.3.
Jan Friedrich reported CVE-2026-105244 in Apache log4net, scored CVSS 3.1 5.3 with low integrity impact and no confidentiality or availability impact. RemoteSyslogAppender removes every character outside visible ASCII and space from syslog records. Affected versions are 1.2.12 before 3.5.0, plus an earlier commit range. The advisory does not describe exploitation.
Key facts
- CVSS 3.1 base score is 5.3, with low integrity impact.
- RemoteSyslogAppender drops characters outside visible ASCII and space.
- Affects log4net 1.2.12 before 3.5.0.
- No privileges or user interaction are required; exploitation is unreported.
- CVEs
- CVE-2026-105244
- Vendors
- Apache Software Foundation
- Products
- Apache log4net
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105244 | Silent non-ASCII stripping in Apache log4net syslog | 5.3 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 56a2e146e21ff4737e1ff3ec308810e667873947 | ions: - Apache log4net 1.2.12 before 3.5.0 - Apache log4net 56a2e146e21ff4737e1ff3ec308810e667873947 before 77717061b20d4346b6c0ce6b54643d85fb348bc7 Description |
| sha1 | 77717061b20d4346b6c0ce6b54643d85fb348bc7 | che log4net 56a2e146e21ff4737e1ff3ec308810e667873947 before 77717061b20d4346b6c0ce6b54643d85fb348bc7 Description: Improper Encoding or Escaping of Output vulner |
From the original article
Posted by Jan Friedrich on Oct 06 Severity: moderate CVSS 3. 1: 5. 3 (medium) CVSS:3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.