Homepage

Improper Encoding or Escaping of Output Affecting log4net package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.82% (57th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ECHOLATEST-LOG4NET-20557222
  • published7 Oct 2026
  • disclosed6 Oct 2026
Report a new vulnerability Found a mistake?

Introduced: 6 Oct 2026

NewCVE-2026-105244  (opens in a new tab)
CWE-116  (opens in a new tab)

How to fix?

There is no fixed version for Echo:latest log4net.

NVD Description

Note: Versions mentioned in the description apply only to the upstream log4net package and not the log4net package as distributed by Echo. See How to fix? for Echo:latest relevant fixed versions and status.

Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.

Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.

This issue affects Apache log4net: from 1.2.12 before 3.5.0.

Users are recommended to upgrade to version 3.5.0, which fixes the issue.