[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-jVr0JxHOKgTeI0bX7uIZFfuMewpeWbtlNOa5xhuG2M":3,"g5a-ex:apache\u002Flog4net@*":106,"g5a-family:apache\u002Flog4net":108},{"success":4,"data":5},true,{"product":6,"versions":35,"topVulnerabilitiesByEpss":45,"kevVulnerabilities":83,"seoMetadata":84,"meta":103},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":34},"apache","log4net",9,2,0,"2020-05-11",[14,17,19,21,23,25,28,30,32],{"version":15,"cve_count":11,"kev_count":11,"has_kev":16},"1.2.10",false,{"version":18,"cve_count":11,"kev_count":11,"has_kev":16},"1.2.11",{"version":20,"cve_count":11,"kev_count":11,"has_kev":16},"1.2.12",{"version":22,"cve_count":11,"kev_count":11,"has_kev":16},"1.2.13",{"version":24,"cve_count":11,"kev_count":11,"has_kev":16},"1.2.15",{"version":26,"cve_count":27,"kev_count":11,"has_kev":16},"1.2.9_beta",1,{"version":29,"cve_count":11,"kev_count":11,"has_kev":16},"2.0.6",{"version":31,"cve_count":11,"kev_count":11,"has_kev":16},"2.0.7",{"version":33,"cve_count":11,"kev_count":11,"has_kev":16},"2.0.8","Log4net by Apache is a technology product with 9 tracked versions and 2 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[36,37,38,39,40,41,42,43,44],{"version":15,"cve_count":11,"kev_count":11,"has_kev":16},{"version":18,"cve_count":11,"kev_count":11,"has_kev":16},{"version":20,"cve_count":11,"kev_count":11,"has_kev":16},{"version":22,"cve_count":11,"kev_count":11,"has_kev":16},{"version":24,"cve_count":11,"kev_count":11,"has_kev":16},{"version":26,"cve_count":27,"kev_count":11,"has_kev":16},{"version":29,"cve_count":11,"kev_count":11,"has_kev":16},{"version":31,"cve_count":11,"kev_count":11,"has_kev":16},{"version":33,"cve_count":11,"kev_count":11,"has_kev":16},[46,53,61,67,70,73,76,80],{"cveId":47,"description":48,"publishedDate":12,"cvssScore":49,"cvssVersion":50,"severity":51,"isKev":16,"epssScore":52},"CVE-2018-1285","Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.",9.8,"v3.1","Critical",0.17823,{"cveId":54,"description":55,"publishedDate":56,"cvssScore":57,"cvssVersion":58,"severity":59,"isKev":16,"epssScore":60},"CVE-2006-0743","Format string vulnerability in LocalSyslogAppender in Apache log4net 1.2.9 might allow remote attackers to cause a denial of service (memory corruption and termination) via unknown vectors.","2006-03-09",5,"v2","Medium",0.06371,{"cveId":62,"description":63,"publishedDate":64,"cvssScore":65,"cvssVersion":50,"severity":59,"isKev":16,"epssScore":66},"CVE-2026-105241","Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net.\n\nContent that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail could be left in the pickup directory. A party whose data reaches a log message could suppress the records of other events. Only applications that use SmtpPickupDirAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue.","2026-10-06",5.3,0.00823,{"cveId":68,"description":69,"publishedDate":64,"cvssScore":65,"cvssVersion":50,"severity":59,"isKev":16,"epssScore":66},"CVE-2026-105242","Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net.\n\nReading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request. Only applications on ASP.NET for .NET Framework whose layout uses %aspnet-request are affected.\n\nThis issue affects Apache log4net: from 1.2.11 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue.",{"cveId":71,"description":72,"publishedDate":64,"cvssScore":65,"cvssVersion":50,"severity":59,"isKev":16,"epssScore":66},"CVE-2026-105244","Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.\n\nEvery character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.12 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue.",{"cveId":74,"description":75,"publishedDate":64,"cvssScore":65,"cvssVersion":50,"severity":59,"isKev":16,"epssScore":66},"CVE-2026-105239","Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net.\n\nA NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently not stored. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use EventLogAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue.",{"cveId":77,"description":78,"publishedDate":64,"cvssScore":65,"cvssVersion":50,"severity":59,"isKev":16,"epssScore":79},"CVE-2026-105243","Insufficient Logging vulnerability in the EventLogAppender of Apache log4net.\n\nLong messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough. Only applications on Windows that use EventLogAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue.",0.00806,{"cveId":81,"description":82,"publishedDate":64,"cvssScore":65,"cvssVersion":50,"severity":59,"isKev":16,"epssScore":79},"CVE-2026-105240","Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net.\n\nA NUL character in logged content ended the debug output record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently lost. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use OutputDebugStringAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue.",[],{"title":85,"metaDescription":86,"keywords":87,"structuredData":88},"Log4net by Apache - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Log4net by Apache covering 9 versions with 2 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Log4net vulnerabilities, Log4net security, Log4net CVE, Apache Log4net, Log4net threat intelligence, Apache security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":89,"@type":90,"name":91,"description":86,"url":92,"manufacturer":93,"applicationCategory":97,"softwareVersion":98,"mainEntity":99},"https:\u002F\u002Fschema.org","SoftwareApplication","Log4net","https:\u002F\u002Fprecursorintelligence.com\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fapache\u002Flog4net",{"@type":94,"name":95,"url":96},"Organization","Apache","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fapache","Security Software","9 versions tracked",{"@type":100,"name":101,"description":102,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Log4net Security Vulnerabilities","Security vulnerabilities affecting Log4net by Apache",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":104,"apiVersion":105},"2026-10-18T16:37:41.438Z","3.0",{"rows":107,"total":11,"capped":16,"failed":11},[],[]]