CVE-2026-105244

Name	CVE-2026-105244
Description	Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected. This issue affects Apache log4net: from 1.2.12 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
log4net (PTS)	trixie	1.2.10+dfsg-9	undetermined
	forky, sid	1.2.10+dfsg-10	undetermined

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
log4net	source	(unstable)	undetermined

Notes

https://github.com/apache/logging-log4net/pull/315
Fixed by: https://github.com/apache/logging-log4net/commit/77717061b20d4346b6c0ce6b54643d85fb348bc7 (rc/3.5.0-rc1)
https://lists.apache.org/thread/q7649hhdodthoqw8jsjgtnb4m8qfy6d6
check, might not affect our old version and upstream claims 1.2.12 onwards