CVE-2026-40021 Details
Description
Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event. An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue.
A vulnerability exists in Apache Log4net's XmlLayout and XmlLayoutSchemaLog4J, in versions prior to 3.3.0. These layouts do not properly sanitize characters in MDC property keys and values, as well as the identity field, that are prohibited by the XML 1.0 specification. This oversight leads to exceptions during serialization and the silent loss of affected log events. An attacker who can manipulate these fields may exploit this vulnerability to suppress individual log records, thereby disrupting audit trails and the detection of malicious activities.
Users are advised to upgrade to Apache Log4net version 3.3.0, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/04/10/11 | CVE | Mailing ListThird Party Advisory |
| https://github.com/apache/logging-log4net/pull/280 | [email protected] | Issue Tracking |
| https://lists.apache.org/thread/q8otftjswhk69n3kxslqg7cobr0x4st7 | [email protected] | Mailing ListVendor Advisory |
| https://logging.apache.org/cyclonedx/vdr.xml | [email protected] | Product |
| https://logging.apache.org/log4net/manual/configuration/layouts.html | [email protected] | Product |
| https://logging.apache.org/security.html#CVE-2026-40021 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| apache log4net | < 3.3.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | Initial Analysis | [email protected] |
| Apr 10, 2026 | CVE Modified | CVE |
| Apr 10, 2026 | New CVE Received | [email protected] |