CVE-2026-40021

Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin.

Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough.

Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request.

Improper Handling of Unicode Encoding in the SmtpPickupDirAppender of Apache log4net. Content the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, makes the write throw, discarding every buffered event in the batch and potentially leaving a truncated mail in the pickup directory. Only applications using SmtpPickupDirAppender are affected, in versions from 1.2.9 before 3.5.0.

Improper Neutralization of Null Byte or NUL Character in the OutputDebugStringAppender of Apache log4net. A NUL character in logged content ends the debug output record at that point, so everything the layout rendered after it, including exception text and trailing fields, is silently lost. Only applications on Windows using OutputDebugStringAppender are affected, in versions from 1.2.9 before 3.5.0.

Improper Neutralization of Null Byte or NUL Character in the EventLogAppender of Apache log4net. A NUL character in logged content ends the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, is silently not stored. Only applications on Windows using EventLogAppender are affected, in versions from 1.2.9 before 3.5.0.