CVE-2026-40021

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-40021", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-04-08T10:03:43.840Z", "datePublished": "2026-04-10T15:44:17.451Z", "dateUpdated": "2026-04-10T17:35:01.228Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://www.nuget.org/packages", "cpes": ["cpe:2.3:a:apache:log4net:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "log4net", "packageURL": "pkg:nuget/log4net", "product": "Apache Log4net", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "3.3.0", "status": "affected", "version": "0", "versionType": "nuget"}]}], "credits": [{"lang": "en", "type": "finder", "value": "f00dat"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Apache Log4net's <code><a target=\"_blank\" rel=\"nofollow\" href=\"https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list\">XmlLayout</a></code> and <code><a target=\"_blank\" rel=\"nofollow\" href=\"https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list\">XmlLayoutSchemaLog4J</a></code>, in versions before 3.3.0, fail to sanitize characters forbidden by the <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.w3.org/TR/xml/#charsets\">XML 1.0 specification</a> in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event.</p><p>An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.</p><p>Users are advised to upgrade to Apache Log4net <code>3.3.0</code>, which fixes this issue.</p>"}], "value": "Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event.\n\nAn attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.\n\nUsers are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-116", "description": "CWE-116 Improper Encoding or Escaping of Output", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-04-10T15:44:17.451Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/apache/logging-log4net/pull/280"}, {"tags": ["vendor-advisory"], "url": "https://logging.apache.org/security.html#CVE-2026-40021"}, {"tags": ["vendor-advisory"], "url": "https://logging.apache.org/cyclonedx/vdr.xml"}, {"tags": ["related"], "url": "https://logging.apache.org/log4net/manual/configuration/layouts.html"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/q8otftjswhk69n3kxslqg7cobr0x4st7"}], "source": {"discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2026-02-10T23:34:00.000Z", "value": "Vulnerability reported by f00dat"}, {"lang": "en", "time": "2026-02-17T08:03:00.000Z", "value": "Fix shared publicly by Jan Friedrich as pull request #280"}, {"lang": "en", "time": "2026-02-20T13:12:00.000Z", "value": "Log4net 3.3.0 released"}], "title": "Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/10/11"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-10T16:18:21.980Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-10T17:32:06.208358Z", "id": "CVE-2026-40021", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T17:35:01.228Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/10/11"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-10T16:18:21.980Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-40021", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-10T17:32:06.208358Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T17:34:55.952Z"}}], "cna": {"title": "Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "f00dat"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"cpes": ["cpe:2.3:a:apache:log4net:*:*:*:*:*:*:*:*"], "vendor": "Apache Software Foundation", "product": "Apache Log4net", "versions": [{"status": "affected", "version": "0", "lessThan": "3.3.0", "versionType": "nuget"}], "packageURL": "pkg:nuget/log4net", "packageName": "log4net", "collectionURL": "https://www.nuget.org/packages", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-10T23:34:00.000Z", "value": "Vulnerability reported by f00dat"}, {"lang": "en", "time": "2026-02-17T08:03:00.000Z", "value": "Fix shared publicly by Jan Friedrich as pull request #280"}, {"lang": "en", "time": "2026-02-20T13:12:00.000Z", "value": "Log4net 3.3.0 released"}], "references": [{"url": "https://github.com/apache/logging-log4net/pull/280", "tags": ["patch"]}, {"url": "https://logging.apache.org/security.html#CVE-2026-40021", "tags": ["vendor-advisory"]}, {"url": "https://logging.apache.org/cyclonedx/vdr.xml", "tags": ["vendor-advisory"]}, {"url": "https://logging.apache.org/log4net/manual/configuration/layouts.html", "tags": ["related"]}, {"url": "https://lists.apache.org/thread/q8otftjswhk69n3kxslqg7cobr0x4st7", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event.\n\nAn attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.\n\nUsers are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue.", "supportingMedia": [{"type": "text/html", "value": "<p>Apache Log4net's <code><a target=\"_blank\" rel=\"nofollow\" href=\"https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list\">XmlLayout</a></code> and <code><a target=\"_blank\" rel=\"nofollow\" href=\"https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list\">XmlLayoutSchemaLog4J</a></code>, in versions before 3.3.0, fail to sanitize characters forbidden by the <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.w3.org/TR/xml/#charsets\">XML 1.0 specification</a> in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event.</p><p>An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.</p><p>Users are advised to upgrade to Apache Log4net <code>3.3.0</code>, which fixes this issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116 Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-04-10T15:44:17.451Z"}}}, "cveMetadata": {"cveId": "CVE-2026-40021", "state": "PUBLISHED", "dateUpdated": "2026-04-10T17:35:01.228Z", "dateReserved": "2026-04-08T10:03:43.840Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-04-10T15:44:17.451Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://www.nuget.org/packages", "cpes": ["cpe:2.3:a:apache:log4net:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "log4net", "packageURL": "pkg:nuget/log4net", "product": "Apache Log4net", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "3.3.0", "status": "affected", "version": "0", "versionType": "nuget"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:log4net:*:*:*:*:*:*:*:*", "matchCriteriaId": "DCD2F9E8-684B-4B34-B48B-32E8225631F3", "versionEndExcluding": "3.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event.\n\nAn attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity.\n\nUsers are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue."}, {"lang": "es", "value": "XmlLayout de Apache Log4net https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list y XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , en versiones anteriores a la 3.3.0, no logran sanear caracteres prohibidos por la especificaci\u00f3n XML 1.0 https://www.w3.org/TR/xml/#charsets en las claves y valores de las propiedades MDC, as\u00ed como en el campo de identidad que puede contener datos influenciados por el atacante. Esto provoca una excepci\u00f3n durante la serializaci\u00f3n y la p\u00e9rdida silenciosa del evento de registro afectado.\n\nUn atacante que pueda influir en cualquiera de estos campos puede explotar esto para suprimir registros de log individuales, perjudicando las pistas de auditor\u00eda y la detecci\u00f3n de actividad maliciosa.\n\nSe aconseja a los usuarios actualizar a Apache Log4net 3.3.0, que corrige este problema."}], "id": "CVE-2026-40021", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@apache.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40021", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-10T17:32:06.208358Z", "version": "2.0.3"}}]}, "published": "2026-04-10T16:16:32.420", "references": [{"source": "security@apache.org", "tags": ["Issue Tracking"], "url": "https://github.com/apache/logging-log4net/pull/280"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/q8otftjswhk69n3kxslqg7cobr0x4st7"}, {"source": "security@apache.org", "tags": ["Product"], "url": "https://logging.apache.org/cyclonedx/vdr.xml"}, {"source": "security@apache.org", "tags": ["Product"], "url": "https://logging.apache.org/log4net/manual/configuration/layouts.html"}, {"source": "security@apache.org", "tags": ["Vendor Advisory"], "url": "https://logging.apache.org/security.html#CVE-2026-40021"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/04/10/11"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-116"}], "source": "security@apache.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.3.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Apache Log4net", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "log4net", "vendor": "apache"}], "analysis": {"en": {"generated_at": "2026-04-10T17:41:14.371445+00:00", "value": {"mitigation_remediation": ["Upgrade Apache Log4net to version\u00a03.3.0 or later, which corrects the input sanitization flaw."], "summary": {"action": "Immediate patch", "impact": "Audit trail suppression"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Apache Log4net libraries released before version\u00a03.3.0. All deployments of Log4net running those older versions are susceptible, regardless of specific host or operating system, as the issue is confined to the library itself.", "description_and_impact": "Apache Log4net\u2019s XmlLayout and XmlLayoutSchemaLog4J fail to escape characters forbidden by the XML\u00a01.0 specification found in MDC property keys and values and in the identity field. When these characters are present, an exception occurs during serialization, causing the entire log event to be silently dropped. This loss of log records directly undermines the reliability of audit logs, which can prevent detection of malicious activity. The weakness is a classic example of improper input sanitization (CWE\u2011116).", "risk_and_exploitability": "The CVSS score of 6.3 indicates a moderate severity, but since the exploitation requires an attacker to inject or influence data that ends up in MDC keys, values, or the identity field, the attack vector is typically through application inputs that are logged. The exact probability of exploitation is unknown because EPSS data are not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker with the ability to control these fields could quietly remove specific log entries, thereby erasing evidence of their activity and weakening defensive monitoring."}}}}, "created": "2026-04-13T12:44:40.084330+00:00", "updated": "2026-04-13T13:01:10.844458+00:00", "vendors": ["apache", "apache$PRODUCT$log4net"]}