log4net
log4net is a tool to help the programmer output log statements to a variety of output targets. In case of problems with an application, it is helpful to enable logging so that the problem can be located. With log4net it is possible to enable logging at runtime without modifying the application binary. The log4net package is designed so that log statements can remain in shipped code without incurring a high performance cost. It follows that the speed of logging (or rather not logging) is crucial. At the same time, log output can be so voluminous that it quickly becomes overwhelming. One of the distinctive features of log4net is the notion of hierarchical loggers. Using these loggers it is possible to selectively control which log statements are output at arbitrary granularity. log4net is designed with two distinct goals in mind: speed and flexibility
Activity
- Latest release
- 3w ago
- Total releases
- 21
- Cadence
- ~2 months
- Last 12 months
- 6
Details
- License
- Apache-2.0
- First release
- Sep 12, 2020
| Version | Released | |
|---|---|---|
3.4.0
minor
|
3.4.0
minor
Dependencies (1)
|
|
3.4.1-preview.1
pre
|
3.4.1-preview.1
pre
Dependencies (1)
|
|
3.4.0-preview.1
pre
|
3.4.0-preview.1
pre
Dependencies (1)
|
|
3.3.2
patch
|
3.3.2
patch
Dependencies (1)
|
|
3.3.1
patch
|
3.3.1
patch
Dependencies (1)
|
|
3.3.0
minor
|
3.3.0
minor
Dependencies (1)
|
|
3.2.0
minor
1 CVE
CVE-2026-40021
GHSA-4f7c-pmjv-c25w
Apr 10, 2026
Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters
Medium
Network
High
None
None
Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event. An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue. Affected versions
1.2.10
1.2.11
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
+ 15 more Show less
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.2.0
Fixed in
3.3.0
References
Updated May 05, 2026 · Source: OSV.dev |
3.2.0
minor
Dependencies (1)
|
|
3.1.0
minor
1 CVE
CVE-2026-40021
GHSA-4f7c-pmjv-c25w
Apr 10, 2026
Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters
Medium
Network
High
None
None
Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event. An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue. Affected versions
1.2.10
1.2.11
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
+ 15 more Show less
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.2.0
Fixed in
3.3.0
References
Updated May 05, 2026 · Source: OSV.dev |
3.1.0
minor
Dependencies (1)
|
|
3.0.4
patch
1 CVE
CVE-2026-40021
GHSA-4f7c-pmjv-c25w
Apr 10, 2026
Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters
Medium
Network
High
None
None
Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event. An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue. Affected versions
1.2.10
1.2.11
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
+ 15 more Show less
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.2.0
Fixed in
3.3.0
References
Updated May 05, 2026 · Source: OSV.dev |
3.0.4
patch
Dependencies (1)
|
|
3.0.3
patch
1 CVE
CVE-2026-40021
GHSA-4f7c-pmjv-c25w
Apr 10, 2026
Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters
Medium
Network
High
None
None
Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event. An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue. Affected versions
1.2.10
1.2.11
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
+ 15 more Show less
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.2.0
Fixed in
3.3.0
References
Updated May 05, 2026 · Source: OSV.dev |
3.0.3
patch
Dependencies (1)
|
|
3.0.2
patch
1 CVE
CVE-2026-40021
GHSA-4f7c-pmjv-c25w
Apr 10, 2026
Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters
Medium
Network
High
None
None
Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event. An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue. Affected versions
1.2.10
1.2.11
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
+ 15 more Show less
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.2.0
Fixed in
3.3.0
References
Updated May 05, 2026 · Source: OSV.dev |
3.0.2
patch
Dependencies (1)
|
|
3.0.1
patch
1 CVE
CVE-2026-40021
GHSA-4f7c-pmjv-c25w
Apr 10, 2026
Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters
Medium
Network
High
None
None
Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event. An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue. Affected versions
1.2.10
1.2.11
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
+ 15 more Show less
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.2.0
Fixed in
3.3.0
References
Updated May 05, 2026 · Source: OSV.dev |
3.0.1
patch
Dependencies (1)
|
|
3.0.0
major
1 CVE
CVE-2026-40021
GHSA-4f7c-pmjv-c25w
Apr 10, 2026
Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters
Medium
Network
High
None
None
Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event. An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue. Affected versions
1.2.10
1.2.11
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
+ 15 more Show less
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.2.0
Fixed in
3.3.0
References
Updated May 05, 2026 · Source: OSV.dev |
3.0.0
major
Dependencies (1)
|
|
2.0.17
patch
1 CVE
CVE-2026-40021
GHSA-4f7c-pmjv-c25w
Apr 10, 2026
Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters
Medium
Network
High
None
None
Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event. An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue. Affected versions
1.2.10
1.2.11
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
+ 15 more Show less
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.2.0
Fixed in
3.3.0
References
Updated May 05, 2026 · Source: OSV.dev |
2.0.17
patch
Dependencies (30)
+ 22 more |
|
2.0.16
patch
1 CVE
CVE-2026-40021
GHSA-4f7c-pmjv-c25w
Apr 10, 2026
Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters
Medium
Network
High
None
None
Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event. An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue. Affected versions
1.2.10
1.2.11
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
+ 15 more Show less
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.2.0
Fixed in
3.3.0
References
Updated May 05, 2026 · Source: OSV.dev |
2.0.16
patch
Dependencies (30)
+ 22 more |
|
2.0.15
patch
1 CVE
CVE-2026-40021
GHSA-4f7c-pmjv-c25w
Apr 10, 2026
Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters
Medium
Network
High
None
None
Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event. An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue. Affected versions
1.2.10
1.2.11
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
+ 15 more Show less
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.2.0
Fixed in
3.3.0
References
Updated May 05, 2026 · Source: OSV.dev |
2.0.15
patch
Dependencies (30)
+ 22 more |
|
2.0.14
patch
1 CVE
CVE-2026-40021
GHSA-4f7c-pmjv-c25w
Apr 10, 2026
Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters
Medium
Network
High
None
None
Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event. An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue. Affected versions
1.2.10
1.2.11
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
+ 15 more Show less
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.2.0
Fixed in
3.3.0
References
Updated May 05, 2026 · Source: OSV.dev |
2.0.14
patch
Dependencies (30)
+ 22 more |
|
2.0.13
patch
1 CVE
CVE-2026-40021
GHSA-4f7c-pmjv-c25w
Apr 10, 2026
Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters
Medium
Network
High
None
None
Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event. An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue. Affected versions
1.2.10
1.2.11
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
+ 15 more Show less
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.2.0
Fixed in
3.3.0
References
Updated May 05, 2026 · Source: OSV.dev |
2.0.13
patch
Dependencies (30)
+ 22 more |
|
2.0.12
patch
1 CVE
CVE-2026-40021
GHSA-4f7c-pmjv-c25w
Apr 10, 2026
Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters
Medium
Network
High
None
None
Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event. An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue. Affected versions
1.2.10
1.2.11
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
+ 15 more Show less
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.2.0
Fixed in
3.3.0
References
Updated May 05, 2026 · Source: OSV.dev |
2.0.12
patch
Dependencies (30)
+ 22 more |
|
2.0.11
patch
1 CVE
CVE-2026-40021
GHSA-4f7c-pmjv-c25w
Apr 10, 2026
Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters
Medium
Network
High
None
None
Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event. An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue. Affected versions
1.2.10
1.2.11
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
+ 15 more Show less
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.2.0
Fixed in
3.3.0
References
Updated May 05, 2026 · Source: OSV.dev |
2.0.11
patch
Dependencies (30)
+ 22 more |
|
2.0.10
initial
1 CVE
CVE-2026-40021
GHSA-4f7c-pmjv-c25w
Apr 10, 2026
Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters
Medium
Network
High
None
None
Apache Log4net's XmlLayout https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list and XmlLayoutSchemaLog4J https://logging.apache.org/log4net/manual/configuration/layouts.html#layout-list , in versions before 3.3.0, fail to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets in MDC property keys and values, as well as the identity field that may carry attacker-influenced data. This causes an exception during serialization and the silent loss of the affected log event. An attacker who can influence any of these fields can exploit this to suppress individual log records, impairing audit trails and detection of malicious activity. Users are advised to upgrade to Apache Log4net 3.3.0, which fixes this issue. Affected versions
1.2.10
1.2.11
2.0.0
2.0.1
2.0.10
2.0.11
2.0.12
2.0.13
2.0.14
2.0.15
2.0.16
2.0.17
+ 15 more Show less
2.0.2
2.0.3
2.0.4
2.0.5
2.0.6
2.0.7
2.0.8
2.0.9
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.2.0
Fixed in
3.3.0
References
Updated May 05, 2026 · Source: OSV.dev |
2.0.10
initial
Dependencies (30)
+ 22 more |