Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
7336 vulnerabilities by apache
CERTFR-2026-AVI-1290
Vulnerability from certfr_avis - Published: 2026-10-09 - Updated: 2026-10-09
De multiples vulnérabilités ont été découvertes dans Apache Struts. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
L'éditeur indique que les versions 2 des Struts ne sont plus maintenues.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Struts version 6.x ant\u00e9rierures \u00e0 6.12.0",
"product": {
"name": "Struts",
"vendor": {
"name": "Apache",
"scada": false
}
}
},
{
"description": "Struts 2",
"product": {
"name": "Struts",
"vendor": {
"name": "Apache",
"scada": false
}
}
},
{
"description": "Struts version 7.x ant\u00e9rierures \u00e0 7.4.0",
"product": {
"name": "Struts",
"vendor": {
"name": "Apache",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-104714",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-104714"
},
{
"name": "CVE-2026-104711",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-104711"
},
{
"name": "CVE-2026-104713",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-104713"
},
{
"name": "CVE-2026-104712",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-104712"
}
],
"initial_release_date": "2026-10-09T00:00:00",
"last_revision_date": "2026-10-09T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1290",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-10-09T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Apache Struts. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n\nL\u0027\u00e9diteur indique que les versions 2 des Struts ne sont plus maintenues. ",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Apache Struts",
"vendor_advisories": [
{
"published_at": "2026-10-02",
"title": "Bulletin de s\u00e9curit\u00e9 Apache Struts S2-077",
"url": "https://cwiki.apache.org/confluence/display/WW/S2-077"
},
{
"published_at": "2026-10-02",
"title": "Bulletin de s\u00e9curit\u00e9 Apache Struts S2-076",
"url": "https://cwiki.apache.org/confluence/display/WW/S2-076"
},
{
"published_at": "2026-10-02",
"title": "Bulletin de s\u00e9curit\u00e9 Apache Struts S2-075",
"url": "https://cwiki.apache.org/confluence/display/WW/S2-075"
},
{
"published_at": "2026-10-02",
"title": "Bulletin de s\u00e9curit\u00e9 Apache Struts S2-078",
"url": "https://cwiki.apache.org/confluence/display/WW/S2-078"
}
]
}
CERTFR-2026-AVI-1248
Vulnerability from certfr_avis - Published: 2026-10-02 - Updated: 2026-10-02
De multiples vulnérabilités ont été découvertes dans Apache HTTP Server. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Apache | HTTP Server | Apache HTTP Server versions antérieures à 2.4.69 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Apache HTTP Server versions ant\u00e9rieures \u00e0 2.4.69",
"product": {
"name": "HTTP Server",
"vendor": {
"name": "Apache",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-48005",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48005"
},
{
"name": "CVE-2026-73637",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73637"
},
{
"name": "CVE-2026-79768",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-79768"
},
{
"name": "CVE-2026-57941",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57941"
},
{
"name": "CVE-2026-63045",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63045"
},
{
"name": "CVE-2026-73636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73636"
},
{
"name": "CVE-2026-56449",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56449"
},
{
"name": "CVE-2026-59797",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59797"
},
{
"name": "CVE-2026-59685",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59685"
},
{
"name": "CVE-2026-46729",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-46729"
},
{
"name": "CVE-2026-42528",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42528"
},
{
"name": "CVE-2026-63292",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63292"
},
{
"name": "CVE-2026-58415",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58415"
},
{
"name": "CVE-2026-63718",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63718"
},
{
"name": "CVE-2026-42356",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42356"
},
{
"name": "CVE-2026-56153",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56153"
},
{
"name": "CVE-2026-56154",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-56154"
},
{
"name": "CVE-2026-63686",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-63686"
},
{
"name": "CVE-2026-93546",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-93546"
},
{
"name": "CVE-2026-47360",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47360"
}
],
"initial_release_date": "2026-10-02T00:00:00",
"last_revision_date": "2026-10-02T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1248",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-10-02T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Apache HTTP Server. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Apache HTTP Server",
"vendor_advisories": [
{
"published_at": "2026-10-01",
"title": "Bulletin de s\u00e9curit\u00e9 Apache HTTP Server CHANGES_2.4.69",
"url": "https://downloads.apache.org/httpd/CHANGES_2.4.69"
}
]
}
CVE-2026-105244 (GCVE-0-2026-105244)
Vulnerability from nvd – Published: 2026-10-06 19:52 – Updated: 2026-10-07 14:50
VLAI
EPSS
VEX
Title
Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content
Summary
Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.
Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.
This issue affects Apache log4net: from 1.2.12 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 14:50 UTC
CWE
- CWE-116 - Improper Encoding or Escaping of Output
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Affected:
1.2.12 , < 3.5.0
(semver)
|
|
| Apache Software Foundation | Apache log4net |
Affected:
56a2e146e21ff4737e1ff3ec308810e667873947 , < 77717061b20d4346b6c0ce6b54643d85fb348bc7
(git)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:12:01.025Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/19"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105244",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T14:50:00.691563Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T14:50:49.648Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.12",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "77717061b20d4346b6c0ce6b54643d85fb348bc7",
"status": "affected",
"version": "56a2e146e21ff4737e1ff3ec308810e667873947",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.\u003cbr\u003e\u003cbr\u003eEvery character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.12 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.\n\nEvery character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.12 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:52:31.116Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/315"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/77717061b20d4346b6c0ce6b54643d85fb348bc7"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/q7649hhdodthoqw8jsjgtnb4m8qfy6d6"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105244",
"datePublished": "2026-10-06T19:52:31.116Z",
"dateReserved": "2026-10-04T16:22:18.416Z",
"dateUpdated": "2026-10-07T14:50:49.648Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105243 (GCVE-0-2026-105243)
Vulnerability from nvd – Published: 2026-10-06 19:51 – Updated: 2026-10-07 14:49
VLAI
EPSS
VEX
Title
Apache log4net: Oversize EventLogAppender record silently discarded
Summary
Insufficient Logging vulnerability in the EventLogAppender of Apache log4net.
Long messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough. Only applications on Windows that use EventLogAppender are affected.
This issue affects Apache log4net: from 1.2.9 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 14:49 UTC
CWE
- CWE-778 - Insufficient Logging
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Affected:
1.2.9 , < 3.5.0
(semver)
|
|
| Apache Software Foundation | Apache log4net |
Affected:
02e1e115435888485f2e28b414d267e39e799e07 , < 28fbfb25678c48a8cc5bc9b94ead0dddfc39ffed
(git)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:11:59.799Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/17"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105243",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T14:49:30.641089Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T14:49:41.976Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.9",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "28fbfb25678c48a8cc5bc9b94ead0dddfc39ffed",
"status": "affected",
"version": "02e1e115435888485f2e28b414d267e39e799e07",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insufficient Logging vulnerability in the EventLogAppender of Apache log4net.\u003cbr\u003e\u003cbr\u003eLong messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough. Only applications on Windows that use EventLogAppender are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Insufficient Logging vulnerability in the EventLogAppender of Apache log4net.\n\nLong messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough. Only applications on Windows that use EventLogAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-778",
"description": "CWE-778 Insufficient Logging",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:51:25.116Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/315"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/28fbfb25678c48a8cc5bc9b94ead0dddfc39ffed"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/jr6fj5skv1vnjbc9jmt8bp151p8ow1rp"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: Oversize EventLogAppender record silently discarded",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105243",
"datePublished": "2026-10-06T19:51:25.116Z",
"dateReserved": "2026-10-04T16:21:38.272Z",
"dateUpdated": "2026-10-07T14:49:41.976Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105242 (GCVE-0-2026-105242)
Vulnerability from nvd – Published: 2026-10-06 19:50 – Updated: 2026-10-07 14:49
VLAI
EPSS
VEX
Title
Apache log4net: Request validation failure drops the event in the aspnet-request converter
Summary
Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net.
Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request. Only applications on ASP.NET for .NET Framework whose layout uses %aspnet-request are affected.
This issue affects Apache log4net: from 1.2.11 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 14:48 UTC
CWE
- CWE-755 - Improper Handling of Exceptional Conditions
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Affected:
1.2.11 , < 3.5.0
(semver)
|
|
| Apache Software Foundation | Apache log4net |
Affected:
243f1e9f3ee235955bade4b4fe664a903378719a , < 145203420c579a703008b4b723b6a080757f4964
(git)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:11:58.703Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/16"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105242",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T14:48:50.404406Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T14:49:06.441Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.11",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "145203420c579a703008b4b723b6a080757f4964",
"status": "affected",
"version": "243f1e9f3ee235955bade4b4fe664a903378719a",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net.\u003cbr\u003e\u003cbr\u003eReading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request. Only applications on ASP.NET for .NET Framework whose layout uses %aspnet-request are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.11 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net.\n\nReading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request. Only applications on ASP.NET for .NET Framework whose layout uses %aspnet-request are affected.\n\nThis issue affects Apache log4net: from 1.2.11 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-755",
"description": "CWE-755 Improper Handling of Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:50:19.075Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/316"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/145203420c579a703008b4b723b6a080757f4964"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/zg6dbqm4ztm7j3c21nfsqj0yxm5yrpdx"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: Request validation failure drops the event in the aspnet-request converter",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105242",
"datePublished": "2026-10-06T19:50:19.075Z",
"dateReserved": "2026-10-04T16:21:12.546Z",
"dateUpdated": "2026-10-07T14:49:06.441Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105241 (GCVE-0-2026-105241)
Vulnerability from nvd – Published: 2026-10-06 19:49 – Updated: 2026-10-07 14:45
VLAI
EPSS
VEX
Title
Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch
Summary
Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net.
Content that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail could be left in the pickup directory. A party whose data reaches a log message could suppress the records of other events. Only applications that use SmtpPickupDirAppender are affected.
This issue affects Apache log4net: from 1.2.9 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 14:44 UTC
CWE
- CWE-176 - Improper Handling of Unicode Encoding
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Affected:
1.2.9 , < 3.5.0
(semver)
|
|
| Apache Software Foundation | Apache log4net |
Affected:
02e1e115435888485f2e28b414d267e39e799e07 , < 4d2e10f0908199604b4326f9df6d0b43b871e333
(git)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:11:57.596Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/15"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105241",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T14:44:42.702949Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T14:45:58.074Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.9",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "4d2e10f0908199604b4326f9df6d0b43b871e333",
"status": "affected",
"version": "02e1e115435888485f2e28b414d267e39e799e07",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net.\u003cbr\u003e\u003cbr\u003eContent that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail could be left in the pickup directory. A party whose data reaches a log message could suppress the records of other events. Only applications that use SmtpPickupDirAppender are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net.\n\nContent that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail could be left in the pickup directory. A party whose data reaches a log message could suppress the records of other events. Only applications that use SmtpPickupDirAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-176",
"description": "CWE-176 Improper Handling of Unicode Encoding",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:49:03.994Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/315"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/4d2e10f0908199604b4326f9df6d0b43b871e333"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/hg8dgh3oy8bp3dhb8nsygk9kw2o401ws"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105241",
"datePublished": "2026-10-06T19:49:03.994Z",
"dateReserved": "2026-10-04T16:20:44.036Z",
"dateUpdated": "2026-10-07T14:45:58.074Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105240 (GCVE-0-2026-105240)
Vulnerability from nvd – Published: 2026-10-06 19:47 – Updated: 2026-10-07 16:27
VLAI
EPSS
VEX
Title
Apache log4net: NUL character truncates OutputDebugStringAppender records
Summary
Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net.
A NUL character in logged content ended the debug output record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently lost. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use OutputDebugStringAppender are affected.
This issue affects Apache log4net: from 1.2.9 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 16:26 UTC
CWE
- CWE-158 - Improper Neutralization of Null Byte or NUL Character
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Affected:
1.2.9 , < 3.5.0
(semver)
|
|
| Apache Software Foundation | Apache log4net |
Affected:
02e1e115435888485f2e28b414d267e39e799e07 , < 6046fe9d7f353b49fe995361c071ec2eea8f7ef6
(git)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:11:56.396Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/18"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105240",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T16:26:58.924030Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T16:27:16.989Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.9",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "6046fe9d7f353b49fe995361c071ec2eea8f7ef6",
"status": "affected",
"version": "02e1e115435888485f2e28b414d267e39e799e07",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net.\u003cbr\u003e\u003cbr\u003eA NUL character in logged content ended the debug output record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently lost. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use OutputDebugStringAppender are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net.\n\nA NUL character in logged content ended the debug output record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently lost. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use OutputDebugStringAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-158",
"description": "CWE-158 Improper Neutralization of Null Byte or NUL Character",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:47:44.900Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/315"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/6046fe9d7f353b49fe995361c071ec2eea8f7ef6"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/gyw2d4ppy82t1vlpdknkfd1nmzp21z17"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: NUL character truncates OutputDebugStringAppender records",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105240",
"datePublished": "2026-10-06T19:47:44.900Z",
"dateReserved": "2026-10-04T16:20:07.533Z",
"dateUpdated": "2026-10-07T16:27:16.989Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105239 (GCVE-0-2026-105239)
Vulnerability from nvd – Published: 2026-10-06 19:46 – Updated: 2026-10-07 06:11
VLAI
EPSS
VEX
Title
Apache log4net: NUL character truncates EventLogAppender records
Summary
Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net.
A NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently not stored. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use EventLogAppender are affected.
This issue affects Apache log4net: from 1.2.9 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:58 UTC
CWE
- CWE-158 - Improper Neutralization of Null Byte or NUL Character
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Affected:
1.2.9 , < 3.5.0
(semver)
|
|
| Apache Software Foundation | Apache log4net |
Affected:
02e1e115435888485f2e28b414d267e39e799e07 , < dc5855a0720c91590fd7a81d729ea01fdd69e000
(git)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105239",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:58:19.202424Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:58:29.347Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:11:55.256Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/14"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.9",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "dc5855a0720c91590fd7a81d729ea01fdd69e000",
"status": "affected",
"version": "02e1e115435888485f2e28b414d267e39e799e07",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net.\u003cbr\u003e\u003cbr\u003eA NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently not stored. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use EventLogAppender are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net.\n\nA NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently not stored. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use EventLogAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-158",
"description": "CWE-158 Improper Neutralization of Null Byte or NUL Character",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:46:33.357Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/315"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/dc5855a0720c91590fd7a81d729ea01fdd69e000"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/9fx1qo5hc0tg8ym0t6p9gt1zpb2qlxpq"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: NUL character truncates EventLogAppender records",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105239",
"datePublished": "2026-10-06T19:46:33.357Z",
"dateReserved": "2026-10-04T16:19:29.460Z",
"dateUpdated": "2026-10-07T06:11:55.256Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104714 (GCVE-0-2026-104714)
Vulnerability from nvd – Published: 2026-10-05 18:36 – Updated: 2026-10-06 14:13
VLAI
EPSS
VEX
Title
Apache Struts: Shared message formatter exposes date and time values across concurrent requests
Summary
Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user's response, or the rendering can fail and surface as a server error. Applications whose localized messages format no date or time arguments are not affected.
This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.
Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 14:13 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cwiki.apache.org/confluence/display/WW/S2-078 | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Struts |
Affected:
2.0.0 , ≤ 2.3.37
(semver)
Affected: 2.5.0 , ≤ 2.5.33 (semver) Affected: 6.0.0 , ≤ 6.11.0 (semver) Affected: 7.0.0 , ≤ 7.3.0 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-05T19:08:44.251Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/05/13"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-104714",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T14:13:22.832050Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T14:13:46.615Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.struts:struts2-core",
"packageURL": "pkg:maven/org.apache.struts/struts2-core",
"product": "Apache Struts",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.3.37",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "2.5.33",
"status": "affected",
"version": "2.5.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.0",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.3.0",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "n0mi1k"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Concurrent execution using shared resource with improper synchronization (\u0027race condition\u0027) vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user\u0027s response, or the rendering can fail and surface as a server error. Applications whose localized messages format no date or time arguments are not affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."
}
],
"value": "Concurrent execution using shared resource with improper synchronization (\u0027race condition\u0027) vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user\u0027s response, or the rendering can fail and surface as a server error. Applications whose localized messages format no date or time arguments are not affected.\n\nThis issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\n\nUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T18:36:49.472Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cwiki.apache.org/confluence/display/WW/S2-078"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Apache Struts: Shared message formatter exposes date and time values across concurrent requests",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-104714",
"datePublished": "2026-10-05T18:36:49.472Z",
"dateReserved": "2026-10-02T10:55:01.052Z",
"dateUpdated": "2026-10-06T14:13:46.615Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104713 (GCVE-0-2026-104713)
Vulnerability from nvd – Published: 2026-10-05 18:36 – Updated: 2026-10-06 14:12
VLAI
EPSS
VEX
Title
Apache Struts: Unbounded request body read in the REST plugin
Summary
Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap and denying service to other users. No additional setting has to be enabled. Applications that do not use the REST plugin are not affected.
This issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.
Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 14:11 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cwiki.apache.org/confluence/display/WW/S2-077 | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Struts |
Affected:
2.1.8 , ≤ 2.3.37
(semver)
Affected: 2.5.0 , ≤ 2.5.33 (semver) Affected: 6.0.0 , ≤ 6.11.0 (semver) Affected: 7.0.0 , ≤ 7.3.0 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-05T19:08:42.973Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/05/12"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-104713",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T14:11:48.988162Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T14:12:55.065Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.struts:struts2-rest-plugin",
"packageURL": "pkg:maven/org.apache.struts/struts2-rest-plugin",
"product": "Apache Struts",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.3.37",
"status": "affected",
"version": "2.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "2.5.33",
"status": "affected",
"version": "2.5.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.0",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.3.0",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "n0mi1k"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap and denying service to other users. No additional setting has to be enabled. Applications that do not use the REST plugin are not affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."
}
],
"value": "Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap and denying service to other users. No additional setting has to be enabled. Applications that do not use the REST plugin are not affected.\n\nThis issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\n\nUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T18:36:09.420Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cwiki.apache.org/confluence/display/WW/S2-077"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Apache Struts: Unbounded request body read in the REST plugin",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-104713",
"datePublished": "2026-10-05T18:36:09.420Z",
"dateReserved": "2026-10-02T10:54:35.480Z",
"dateUpdated": "2026-10-06T14:12:55.065Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104712 (GCVE-0-2026-104712)
Vulnerability from nvd – Published: 2026-10-05 18:35 – Updated: 2026-10-06 14:10
VLAI
EPSS
VEX
Title
Apache Struts: Disproportionate response size when rendering BigDecimal request parameters
Summary
Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude larger than the request, allowing an unauthenticated remote attacker to exhaust server CPU and outbound network capacity with sustained low-volume traffic. Applications that do not bind request parameters to BigDecimal properties, or never render such a property through the Struts tag library, are not affected.
This issue affects Apache Struts: from 2.5.14 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.
Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 14:09 UTC
CWE
- CWE-405 - Asymmetric Resource Consumption (Amplification)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cwiki.apache.org/confluence/display/WW/S2-076 | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Struts |
Affected:
2.5.14 , ≤ 2.5.33
(semver)
Affected: 6.0.0 , ≤ 6.11.0 (semver) Affected: 7.0.0 , ≤ 7.3.0 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-05T19:08:41.655Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/05/11"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-104712",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T14:09:49.658503Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T14:10:31.329Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.struts:struts2-core",
"packageURL": "pkg:maven/org.apache.struts/struts2-core",
"product": "Apache Struts",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.5.33",
"status": "affected",
"version": "2.5.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.0",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.3.0",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "0xCc.zhang"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude larger than the request, allowing an unauthenticated remote attacker to exhaust server CPU and outbound network capacity with sustained low-volume traffic. Applications that do not bind request parameters to BigDecimal properties, or never render such a property through the Struts tag library, are not affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache Struts: from 2.5.14 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."
}
],
"value": "Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude larger than the request, allowing an unauthenticated remote attacker to exhaust server CPU and outbound network capacity with sustained low-volume traffic. Applications that do not bind request parameters to BigDecimal properties, or never render such a property through the Struts tag library, are not affected.\n\nThis issue affects Apache Struts: from 2.5.14 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\n\nUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-405",
"description": "CWE-405 Asymmetric Resource Consumption (Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T18:35:41.767Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cwiki.apache.org/confluence/display/WW/S2-076"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Apache Struts: Disproportionate response size when rendering BigDecimal request parameters",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-104712",
"datePublished": "2026-10-05T18:35:41.767Z",
"dateReserved": "2026-10-02T10:54:11.636Z",
"dateUpdated": "2026-10-06T14:10:31.329Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104711 (GCVE-0-2026-104711)
Vulnerability from nvd – Published: 2026-10-05 18:35 – Updated: 2026-10-06 14:09
VLAI
EPSS
VEX
Title
Apache Struts: OGNL injection in the legacy RESTful action mapper
Summary
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected.
This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.
Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 14:08 UTC
CWE
- CWE-917 - Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cwiki.apache.org/confluence/display/WW/S2-075 | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Struts |
Affected:
2.0.0 , ≤ 2.3.37
(semver)
Affected: 2.5.0 , ≤ 2.5.33 (semver) Affected: 6.0.0 , ≤ 6.11.0 (semver) Affected: 7.0.0 , ≤ 7.3.0 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-05T19:08:40.353Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/05/10"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-104711",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T14:08:35.909211Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T14:09:06.711Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.struts:struts2-core",
"packageURL": "pkg:maven/org.apache.struts/struts2-core",
"product": "Apache Struts",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.3.37",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "2.5.33",
"status": "affected",
"version": "2.5.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.0",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.3.0",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "LeaveSong"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper neutralization of special elements used in an expression language statement (\u0027Expression Language Injection\u0027) vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."
}
],
"value": "Improper neutralization of special elements used in an expression language statement (\u0027Expression Language Injection\u0027) vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected.\n\nThis issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\n\nUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-917",
"description": "CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T18:35:10.026Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cwiki.apache.org/confluence/display/WW/S2-075"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Apache Struts: OGNL injection in the legacy RESTful action mapper",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-104711",
"datePublished": "2026-10-05T18:35:10.026Z",
"dateReserved": "2026-10-02T10:53:37.312Z",
"dateUpdated": "2026-10-06T14:09:06.711Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93546 (GCVE-0-2026-93546)
Vulnerability from nvd – Published: 2026-10-01 16:19 – Updated: 2026-10-01 20:09
VLAI
EPSS
VEX
Title
Apache HTTP Server: mod_dav_fs namespace overflow
Summary
Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory's property database via PROPPATCH requests declaring many XML namespaces.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 19:38 UTC
CWE
- CWE-190 - Integer overflow or wraparound
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://httpd.apache.org/security/vulnerabilities… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server |
Affected:
0 , ≤ 2.4.68
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-93546",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T19:38:29.562581Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T19:38:34.954Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-01T20:09:35.921Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/01/30"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache HTTP Server",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.4.68",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhen Kong"
},
{
"lang": "en",
"type": "finder",
"value": "Calif.io in collaboration with Anthropic"
},
{
"lang": "en",
"type": "finder",
"value": "AISLE in partnership with Red Hat"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory\u0027s property database via PROPPATCH requests declaring many XML namespaces."
}
],
"value": "Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a directory\u0027s property database via PROPPATCH requests declaring many XML namespaces."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190 Integer overflow or wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T16:19:32.662Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2026-07-28T12:00:00.000Z",
"value": "reported"
},
{
"lang": "en",
"time": "2026-10-01T12:00:00.000Z",
"value": "fixed in 2.4.x by r1938682"
},
{
"lang": "eng",
"time": "2026-10-01T12:00:00.000Z",
"value": "2.4.69 released"
}
],
"title": "Apache HTTP Server: mod_dav_fs namespace overflow",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-93546",
"datePublished": "2026-10-01T16:19:32.662Z",
"dateReserved": "2026-09-18T09:17:50.552Z",
"dateUpdated": "2026-10-01T20:09:35.921Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79768 (GCVE-0-2026-79768)
Vulnerability from nvd – Published: 2026-10-01 16:18 – Updated: 2026-10-01 20:09
VLAI
EPSS
VEX
Title
Apache HTTP Server: mod_userdir information disclosure
Summary
Path equivalence: '/./' (single dot directory) vulnerability in Apache HTTP Server's mod_userdir module when configured with absolute non-wildcard UserDir directive (the 2nd form in https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir)
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 19:41 UTC
CWE
- CWE-55 - Path equivalence: '/./' (single dot directory)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://httpd.apache.org/security/vulnerabilities… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server |
Affected:
2.4.0 , ≤ 2.4.68
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-79768",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T19:41:17.533835Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T19:41:21.194Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-01T20:09:34.983Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/01/29"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache HTTP Server",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.4.68",
"status": "affected",
"version": "2.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Vlatko Kosturjak, Marlink Cyber"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003ePath equivalence: \u0027/./\u0027 (single dot directory) vulnerability in Apache HTTP Server\u0027s mod_userdir module when configured with\u0026nbsp;absolute non-wildcard UserDir directive (the 2nd form in\u0026nbsp;https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir)\u003c/p\u003e\u003cp\u003eThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68.\u003c/p\u003e"
}
],
"value": "Path equivalence: \u0027/./\u0027 (single dot directory) vulnerability in Apache HTTP Server\u0027s mod_userdir module when configured with\u00a0absolute non-wildcard UserDir directive (the 2nd form in\u00a0https://httpd.apache.org/docs/2.4/mod/mod_userdir.html#userdir)\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.0 through 2.4.68."
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-55",
"description": "CWE-55 Path equivalence: \u0027/./\u0027 (single dot directory)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T16:18:57.661Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2026-08-14T15:36:00.000Z",
"value": "reported"
},
{
"lang": "en",
"time": "2026-10-01T12:00:00.000Z",
"value": "fixed in 2.4.x by r1938680"
},
{
"lang": "eng",
"time": "2026-10-01T12:00:00.000Z",
"value": "2.4.69 released"
}
],
"title": "Apache HTTP Server: mod_userdir information disclosure",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-79768",
"datePublished": "2026-10-01T16:18:57.661Z",
"dateReserved": "2026-08-25T14:25:35.993Z",
"dateUpdated": "2026-10-01T20:09:34.983Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73637 (GCVE-0-2026-73637)
Vulnerability from nvd – Published: 2026-10-01 16:18 – Updated: 2026-10-01 20:09
VLAI
EPSS
VEX
Title
Apache HTTP Server: mod_auth_digest DoS attack
Summary
Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 19:42 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://httpd.apache.org/security/vulnerabilities… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server |
Affected:
2.4.0 , ≤ 2.4.68
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-73637",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T19:42:16.346387Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T19:42:19.411Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-01T20:09:34.038Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/01/28"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache HTTP Server",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.4.68",
"status": "affected",
"version": "2.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhen Kong"
},
{
"lang": "en",
"type": "finder",
"value": "Darren Carreras (DarrenC)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 2.4.69, which fixes this issue."
}
],
"value": "Use after free in mod_auth_digest in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an unauthenticated remote client to cause authentication state corruption via concurrent Digest authentication requests when AuthDigestNcCheck is enabled or AuthDigestNonceLifetime is set to 0.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T16:18:30.190Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2026-07-18T23:22:00.000Z",
"value": "Report received"
},
{
"lang": "en",
"time": "2026-10-01T12:00:00.000Z",
"value": "fixed in 2.4.x by r1937721"
},
{
"lang": "eng",
"time": "2026-10-01T12:00:00.000Z",
"value": "2.4.69 released"
}
],
"title": "Apache HTTP Server: mod_auth_digest DoS attack",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-73637",
"datePublished": "2026-10-01T16:18:30.190Z",
"dateReserved": "2026-08-13T12:48:43.755Z",
"dateUpdated": "2026-10-01T20:09:34.038Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73636 (GCVE-0-2026-73636)
Vulnerability from nvd – Published: 2026-10-01 16:17 – Updated: 2026-10-01 20:09
VLAI
EPSS
VEX
Title
Apache HTTP Server: mod_auth_digest one-time-nonce replay attack
Summary
Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client's shared memory entry when AuthDigestNonceLifetime is set to 0.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 19:43 UTC
CWE
- CWE-294 - Authentication Bypass by Capture-replay
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://httpd.apache.org/security/vulnerabilities… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server |
Affected:
2.4.0 , ≤ 2.4.68
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-73636",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T19:43:35.472082Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T19:43:38.554Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-01T20:09:33.050Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/01/27"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache HTTP Server",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.4.68",
"status": "affected",
"version": "2.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Hyojae Lee"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client\u0027s shared memory entry when AuthDigestNonceLifetime is set to 0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 2.4.69, which fixes this issue."
}
],
"value": "Authentication bypass by capture-replay in mod_auth_digest in Apache Software Foundation Apache HTTP Server 2.4.x on all platforms allows a man-in-the-middle (MITM) attacker to replay captured digest authentication credentials via crafted requests that trigger garbage collection of the client\u0027s shared memory entry when AuthDigestNonceLifetime is set to 0.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-294",
"description": "CWE-294 Authentication Bypass by Capture-replay",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T16:17:59.618Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2026-06-08T01:36:00.000Z",
"value": "Report received"
},
{
"lang": "en",
"time": "2026-10-01T12:00:00.000Z",
"value": "fixed in 2.4.x by r1937721"
},
{
"lang": "eng",
"time": "2026-10-01T12:00:00.000Z",
"value": "2.4.69 released"
}
],
"title": "Apache HTTP Server: mod_auth_digest one-time-nonce replay attack",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-73636",
"datePublished": "2026-10-01T16:17:59.618Z",
"dateReserved": "2026-08-13T12:47:45.798Z",
"dateUpdated": "2026-10-01T20:09:33.050Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63718 (GCVE-0-2026-63718)
Vulnerability from nvd – Published: 2026-10-01 16:17 – Updated: 2026-10-01 20:09
VLAI
EPSS
VEX
Title
Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling
Summary
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding.
This issue affects Apache HTTP Server: from 2.4.30 through 2.4.68.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 19:44 UTC
CWE
- CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://httpd.apache.org/security/vulnerabilities… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server |
Affected:
2.4.30 , ≤ 2.4.68
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-63718",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T19:44:40.051855Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T19:44:42.977Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-01T20:09:32.103Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/01/26"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache HTTP Server",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.4.68",
"status": "affected",
"version": "2.4.30",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Qing Xu"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027) response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding.\u003c/p\u003e\u003cp\u003eThis issue affects Apache HTTP Server: from 2.4.30 through 2.4.68.\u003c/p\u003e\u003cp\u003e\u003cbr\u003e\u003c/p\u003e"
}
],
"value": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027) response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi response with Transfer-Encoding.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.30 through 2.4.68."
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-444",
"description": "CWE-444 Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T16:17:06.585Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2026-07-14T12:00:00.000Z",
"value": "reported"
},
{
"lang": "en",
"time": "2026-10-01T12:00:00.000Z",
"value": "fixed in 2.4.x by r1938691"
},
{
"lang": "eng",
"time": "2026-10-01T12:00:00.000Z",
"value": "2.4.69 released"
}
],
"title": "Apache HTTP Server: mod_proxy_uwsgi Transfer-Encoding response smuggling",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-63718",
"datePublished": "2026-10-01T16:17:06.585Z",
"dateReserved": "2026-07-17T19:48:18.493Z",
"dateUpdated": "2026-10-01T20:09:32.103Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63686 (GCVE-0-2026-63686)
Vulnerability from nvd – Published: 2026-10-01 16:20 – Updated: 2026-10-01 20:09
VLAI
EPSS
VEX
Title
Apache HTTP Server: mod_xml2enc crash on charset conversion failure
Summary
A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 19:34 UTC
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://httpd.apache.org/security/vulnerabilities… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server |
Affected:
2.4.0 , ≤ 2.4.68
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-63686",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T19:34:34.341515Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T19:34:37.183Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-01T20:09:31.181Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/01/25"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache HTTP Server",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.4.68",
"status": "affected",
"version": "2.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lucian Nitescu"
},
{
"lang": "en",
"type": "finder",
"value": "Zhen Kong"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 2.4.69, which fixes this issue."
}
],
"value": "A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of service via a proxied response with a charset whose conversion partially succeeds then fails.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T16:20:14.360Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2026-06-14T16:08:00.000Z",
"value": "Report received"
},
{
"lang": "en",
"time": "2026-10-01T12:00:00.000Z",
"value": "fixed in 2.4.x by r1938678"
},
{
"lang": "eng",
"time": "2026-10-01T12:00:00.000Z",
"value": "2.4.69 released"
}
],
"title": "Apache HTTP Server: mod_xml2enc crash on charset conversion failure",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-63686",
"datePublished": "2026-10-01T16:20:14.360Z",
"dateReserved": "2026-07-17T16:04:47.692Z",
"dateUpdated": "2026-10-01T20:09:31.181Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63292 (GCVE-0-2026-63292)
Vulnerability from nvd – Published: 2026-10-01 16:11 – Updated: 2026-10-01 20:09
VLAI
EPSS
VEX
Title
Apache HTTP Server: mod_vhost_alias stack overflow
Summary
Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 18:19 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://httpd.apache.org/security/vulnerabilities… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server |
Affected:
2.4.0 , ≤ 2.4.68
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-63292",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T18:19:50.244775Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T18:20:11.369Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-01T20:09:30.262Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/01/24"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache HTTP Server",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.4.68",
"status": "affected",
"version": "2.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Hyojae Lee"
},
{
"lang": "en",
"type": "finder",
"value": "Zhen Kong"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 2.4.69, which fixes this issue."
}
],
"value": "Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of service or potentially execute arbitrary code via an HTTP request with a Host header exceeding 8192 bytes when VirtualDocumentRoot uses a hostname format specifier and LimitRequestFieldSize is raised above the default.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T16:11:47.911Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2026-06-17T23:29:00.000Z",
"value": "Report received"
},
{
"lang": "en",
"time": "2026-10-01T12:00:00.000Z",
"value": "fixed in 2.4.x by r1938676"
},
{
"lang": "eng",
"time": "2026-10-01T12:00:00.000Z",
"value": "2.4.69 released"
}
],
"title": "Apache HTTP Server: mod_vhost_alias stack overflow",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-63292",
"datePublished": "2026-10-01T16:11:47.911Z",
"dateReserved": "2026-07-16T09:06:13.760Z",
"dateUpdated": "2026-10-01T20:09:30.262Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63045 (GCVE-0-2026-63045)
Vulnerability from nvd – Published: 2026-10-01 16:09 – Updated: 2026-10-01 20:09
VLAI
EPSS
VEX
Title
Apache HTTP Server: mod_proxy_ftp PASV address handling
Summary
Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.
Users are recommended to upgrade to version 2.4.69, which fixes this issue.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 18:30 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://httpd.apache.org/security/vulnerabilities… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache HTTP Server |
Affected:
2.4.0 , ≤ 2.4.68
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-63045",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T18:30:13.273627Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T18:31:02.817Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-01T20:09:29.345Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/01/23"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache HTTP Server",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.4.68",
"status": "affected",
"version": "2.4.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Zhen Kong"
},
{
"lang": "en",
"type": "finder",
"value": "4ra1n, pyn3rd and unam4"
},
{
"lang": "en",
"type": "finder",
"value": "Charles Vosburgh"
},
{
"lang": "en",
"type": "finder",
"value": "sungbyeongchan"
},
{
"lang": "en",
"type": "finder",
"value": "Daradigu / RELAUNCH DEPT."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 2.4.69, which fixes this issue."
}
],
"value": "Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows, in forward proxy configurations, an untrusted FTP server to cause the proxy to open a data connection to an arbitrary third-party host via a crafted PASV response.\n\nUsers are recommended to upgrade to version 2.4.69, which fixes this issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T16:09:07.643Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://httpd.apache.org/security/vulnerabilities_24.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"timeline": [
{
"lang": "en",
"time": "2026-07-07T16:26:00.000Z",
"value": "Report received"
},
{
"lang": "en",
"time": "2026-10-01T12:00:00.000Z",
"value": "fixed in 2.4.x by r1938674"
},
{
"lang": "eng",
"time": "2026-10-01T12:00:00.000Z",
"value": "2.4.69 released"
}
],
"title": "Apache HTTP Server: mod_proxy_ftp PASV address handling",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-63045",
"datePublished": "2026-10-01T16:09:07.643Z",
"dateReserved": "2026-07-15T07:09:43.751Z",
"dateUpdated": "2026-10-01T20:09:29.345Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105244 (GCVE-0-2026-105244)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:52 – Updated: 2026-10-07 14:50
VLAI
EPSS
VEX
Title
Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content
Summary
Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.
Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.
This issue affects Apache log4net: from 1.2.12 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 14:50 UTC
CWE
- CWE-116 - Improper Encoding or Escaping of Output
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Affected:
1.2.12 , < 3.5.0
(semver)
|
|
| Apache Software Foundation | Apache log4net |
Affected:
56a2e146e21ff4737e1ff3ec308810e667873947 , < 77717061b20d4346b6c0ce6b54643d85fb348bc7
(git)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:12:01.025Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/19"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105244",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T14:50:00.691563Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T14:50:49.648Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.12",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "77717061b20d4346b6c0ce6b54643d85fb348bc7",
"status": "affected",
"version": "56a2e146e21ff4737e1ff3ec308810e667873947",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.\u003cbr\u003e\u003cbr\u003eEvery character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.12 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.\n\nEvery character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.12 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:52:31.116Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/315"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/77717061b20d4346b6c0ce6b54643d85fb348bc7"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/q7649hhdodthoqw8jsjgtnb4m8qfy6d6"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105244",
"datePublished": "2026-10-06T19:52:31.116Z",
"dateReserved": "2026-10-04T16:22:18.416Z",
"dateUpdated": "2026-10-07T14:50:49.648Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105243 (GCVE-0-2026-105243)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:51 – Updated: 2026-10-07 14:49
VLAI
EPSS
VEX
Title
Apache log4net: Oversize EventLogAppender record silently discarded
Summary
Insufficient Logging vulnerability in the EventLogAppender of Apache log4net.
Long messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough. Only applications on Windows that use EventLogAppender are affected.
This issue affects Apache log4net: from 1.2.9 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 14:49 UTC
CWE
- CWE-778 - Insufficient Logging
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Affected:
1.2.9 , < 3.5.0
(semver)
|
|
| Apache Software Foundation | Apache log4net |
Affected:
02e1e115435888485f2e28b414d267e39e799e07 , < 28fbfb25678c48a8cc5bc9b94ead0dddfc39ffed
(git)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:11:59.799Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/17"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105243",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T14:49:30.641089Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T14:49:41.976Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.9",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "28fbfb25678c48a8cc5bc9b94ead0dddfc39ffed",
"status": "affected",
"version": "02e1e115435888485f2e28b414d267e39e799e07",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insufficient Logging vulnerability in the EventLogAppender of Apache log4net.\u003cbr\u003e\u003cbr\u003eLong messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough. Only applications on Windows that use EventLogAppender are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Insufficient Logging vulnerability in the EventLogAppender of Apache log4net.\n\nLong messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough. Only applications on Windows that use EventLogAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-778",
"description": "CWE-778 Insufficient Logging",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:51:25.116Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/315"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/28fbfb25678c48a8cc5bc9b94ead0dddfc39ffed"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/jr6fj5skv1vnjbc9jmt8bp151p8ow1rp"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: Oversize EventLogAppender record silently discarded",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105243",
"datePublished": "2026-10-06T19:51:25.116Z",
"dateReserved": "2026-10-04T16:21:38.272Z",
"dateUpdated": "2026-10-07T14:49:41.976Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105242 (GCVE-0-2026-105242)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:50 – Updated: 2026-10-07 14:49
VLAI
EPSS
VEX
Title
Apache log4net: Request validation failure drops the event in the aspnet-request converter
Summary
Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net.
Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request. Only applications on ASP.NET for .NET Framework whose layout uses %aspnet-request are affected.
This issue affects Apache log4net: from 1.2.11 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 14:48 UTC
CWE
- CWE-755 - Improper Handling of Exceptional Conditions
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Affected:
1.2.11 , < 3.5.0
(semver)
|
|
| Apache Software Foundation | Apache log4net |
Affected:
243f1e9f3ee235955bade4b4fe664a903378719a , < 145203420c579a703008b4b723b6a080757f4964
(git)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:11:58.703Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/16"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105242",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T14:48:50.404406Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T14:49:06.441Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.11",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "145203420c579a703008b4b723b6a080757f4964",
"status": "affected",
"version": "243f1e9f3ee235955bade4b4fe664a903378719a",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net.\u003cbr\u003e\u003cbr\u003eReading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request. Only applications on ASP.NET for .NET Framework whose layout uses %aspnet-request are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.11 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net.\n\nReading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request. Only applications on ASP.NET for .NET Framework whose layout uses %aspnet-request are affected.\n\nThis issue affects Apache log4net: from 1.2.11 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-755",
"description": "CWE-755 Improper Handling of Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:50:19.075Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/316"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/145203420c579a703008b4b723b6a080757f4964"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/zg6dbqm4ztm7j3c21nfsqj0yxm5yrpdx"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: Request validation failure drops the event in the aspnet-request converter",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105242",
"datePublished": "2026-10-06T19:50:19.075Z",
"dateReserved": "2026-10-04T16:21:12.546Z",
"dateUpdated": "2026-10-07T14:49:06.441Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105241 (GCVE-0-2026-105241)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:49 – Updated: 2026-10-07 14:45
VLAI
EPSS
VEX
Title
Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch
Summary
Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net.
Content that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail could be left in the pickup directory. A party whose data reaches a log message could suppress the records of other events. Only applications that use SmtpPickupDirAppender are affected.
This issue affects Apache log4net: from 1.2.9 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 14:44 UTC
CWE
- CWE-176 - Improper Handling of Unicode Encoding
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Affected:
1.2.9 , < 3.5.0
(semver)
|
|
| Apache Software Foundation | Apache log4net |
Affected:
02e1e115435888485f2e28b414d267e39e799e07 , < 4d2e10f0908199604b4326f9df6d0b43b871e333
(git)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:11:57.596Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/15"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105241",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T14:44:42.702949Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T14:45:58.074Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.9",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "4d2e10f0908199604b4326f9df6d0b43b871e333",
"status": "affected",
"version": "02e1e115435888485f2e28b414d267e39e799e07",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net.\u003cbr\u003e\u003cbr\u003eContent that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail could be left in the pickup directory. A party whose data reaches a log message could suppress the records of other events. Only applications that use SmtpPickupDirAppender are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net.\n\nContent that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail could be left in the pickup directory. A party whose data reaches a log message could suppress the records of other events. Only applications that use SmtpPickupDirAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-176",
"description": "CWE-176 Improper Handling of Unicode Encoding",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:49:03.994Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/315"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/4d2e10f0908199604b4326f9df6d0b43b871e333"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/hg8dgh3oy8bp3dhb8nsygk9kw2o401ws"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105241",
"datePublished": "2026-10-06T19:49:03.994Z",
"dateReserved": "2026-10-04T16:20:44.036Z",
"dateUpdated": "2026-10-07T14:45:58.074Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105240 (GCVE-0-2026-105240)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:47 – Updated: 2026-10-07 16:27
VLAI
EPSS
VEX
Title
Apache log4net: NUL character truncates OutputDebugStringAppender records
Summary
Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net.
A NUL character in logged content ended the debug output record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently lost. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use OutputDebugStringAppender are affected.
This issue affects Apache log4net: from 1.2.9 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 16:26 UTC
CWE
- CWE-158 - Improper Neutralization of Null Byte or NUL Character
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Affected:
1.2.9 , < 3.5.0
(semver)
|
|
| Apache Software Foundation | Apache log4net |
Affected:
02e1e115435888485f2e28b414d267e39e799e07 , < 6046fe9d7f353b49fe995361c071ec2eea8f7ef6
(git)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:11:56.396Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/18"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105240",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T16:26:58.924030Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T16:27:16.989Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.9",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "6046fe9d7f353b49fe995361c071ec2eea8f7ef6",
"status": "affected",
"version": "02e1e115435888485f2e28b414d267e39e799e07",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net.\u003cbr\u003e\u003cbr\u003eA NUL character in logged content ended the debug output record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently lost. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use OutputDebugStringAppender are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net.\n\nA NUL character in logged content ended the debug output record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently lost. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use OutputDebugStringAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-158",
"description": "CWE-158 Improper Neutralization of Null Byte or NUL Character",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:47:44.900Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/315"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/6046fe9d7f353b49fe995361c071ec2eea8f7ef6"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/gyw2d4ppy82t1vlpdknkfd1nmzp21z17"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: NUL character truncates OutputDebugStringAppender records",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105240",
"datePublished": "2026-10-06T19:47:44.900Z",
"dateReserved": "2026-10-04T16:20:07.533Z",
"dateUpdated": "2026-10-07T16:27:16.989Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105239 (GCVE-0-2026-105239)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:46 – Updated: 2026-10-07 06:11
VLAI
EPSS
VEX
Title
Apache log4net: NUL character truncates EventLogAppender records
Summary
Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net.
A NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently not stored. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use EventLogAppender are affected.
This issue affects Apache log4net: from 1.2.9 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:58 UTC
CWE
- CWE-158 - Improper Neutralization of Null Byte or NUL Character
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Affected:
1.2.9 , < 3.5.0
(semver)
|
|
| Apache Software Foundation | Apache log4net |
Affected:
02e1e115435888485f2e28b414d267e39e799e07 , < dc5855a0720c91590fd7a81d729ea01fdd69e000
(git)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105239",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:58:19.202424Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:58:29.347Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:11:55.256Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/14"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.9",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "dc5855a0720c91590fd7a81d729ea01fdd69e000",
"status": "affected",
"version": "02e1e115435888485f2e28b414d267e39e799e07",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net.\u003cbr\u003e\u003cbr\u003eA NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently not stored. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use EventLogAppender are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net.\n\nA NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently not stored. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use EventLogAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-158",
"description": "CWE-158 Improper Neutralization of Null Byte or NUL Character",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:46:33.357Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/315"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/dc5855a0720c91590fd7a81d729ea01fdd69e000"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/9fx1qo5hc0tg8ym0t6p9gt1zpb2qlxpq"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: NUL character truncates EventLogAppender records",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105239",
"datePublished": "2026-10-06T19:46:33.357Z",
"dateReserved": "2026-10-04T16:19:29.460Z",
"dateUpdated": "2026-10-07T06:11:55.256Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104714 (GCVE-0-2026-104714)
Vulnerability from cvelistv5 – Published: 2026-10-05 18:36 – Updated: 2026-10-06 14:13
VLAI
EPSS
VEX
Title
Apache Struts: Shared message formatter exposes date and time values across concurrent requests
Summary
Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user's response, or the rendering can fail and surface as a server error. Applications whose localized messages format no date or time arguments are not affected.
This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.
Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 14:13 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cwiki.apache.org/confluence/display/WW/S2-078 | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Struts |
Affected:
2.0.0 , ≤ 2.3.37
(semver)
Affected: 2.5.0 , ≤ 2.5.33 (semver) Affected: 6.0.0 , ≤ 6.11.0 (semver) Affected: 7.0.0 , ≤ 7.3.0 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-05T19:08:44.251Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/05/13"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-104714",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T14:13:22.832050Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T14:13:46.615Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.struts:struts2-core",
"packageURL": "pkg:maven/org.apache.struts/struts2-core",
"product": "Apache Struts",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.3.37",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "2.5.33",
"status": "affected",
"version": "2.5.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.0",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.3.0",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "n0mi1k"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Concurrent execution using shared resource with improper synchronization (\u0027race condition\u0027) vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user\u0027s response, or the rendering can fail and surface as a server error. Applications whose localized messages format no date or time arguments are not affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."
}
],
"value": "Concurrent execution using shared resource with improper synchronization (\u0027race condition\u0027) vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user\u0027s response, or the rendering can fail and surface as a server error. Applications whose localized messages format no date or time arguments are not affected.\n\nThis issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\n\nUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T18:36:49.472Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cwiki.apache.org/confluence/display/WW/S2-078"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Apache Struts: Shared message formatter exposes date and time values across concurrent requests",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-104714",
"datePublished": "2026-10-05T18:36:49.472Z",
"dateReserved": "2026-10-02T10:55:01.052Z",
"dateUpdated": "2026-10-06T14:13:46.615Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104713 (GCVE-0-2026-104713)
Vulnerability from cvelistv5 – Published: 2026-10-05 18:36 – Updated: 2026-10-06 14:12
VLAI
EPSS
VEX
Title
Apache Struts: Unbounded request body read in the REST plugin
Summary
Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap and denying service to other users. No additional setting has to be enabled. Applications that do not use the REST plugin are not affected.
This issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.
Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 14:11 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cwiki.apache.org/confluence/display/WW/S2-077 | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Struts |
Affected:
2.1.8 , ≤ 2.3.37
(semver)
Affected: 2.5.0 , ≤ 2.5.33 (semver) Affected: 6.0.0 , ≤ 6.11.0 (semver) Affected: 7.0.0 , ≤ 7.3.0 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-05T19:08:42.973Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/05/12"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-104713",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T14:11:48.988162Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T14:12:55.065Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.struts:struts2-rest-plugin",
"packageURL": "pkg:maven/org.apache.struts/struts2-rest-plugin",
"product": "Apache Struts",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.3.37",
"status": "affected",
"version": "2.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "2.5.33",
"status": "affected",
"version": "2.5.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.0",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.3.0",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "n0mi1k"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap and denying service to other users. No additional setting has to be enabled. Applications that do not use the REST plugin are not affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."
}
],
"value": "Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap and denying service to other users. No additional setting has to be enabled. Applications that do not use the REST plugin are not affected.\n\nThis issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\n\nUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T18:36:09.420Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cwiki.apache.org/confluence/display/WW/S2-077"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Apache Struts: Unbounded request body read in the REST plugin",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-104713",
"datePublished": "2026-10-05T18:36:09.420Z",
"dateReserved": "2026-10-02T10:54:35.480Z",
"dateUpdated": "2026-10-06T14:12:55.065Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104712 (GCVE-0-2026-104712)
Vulnerability from cvelistv5 – Published: 2026-10-05 18:35 – Updated: 2026-10-06 14:10
VLAI
EPSS
VEX
Title
Apache Struts: Disproportionate response size when rendering BigDecimal request parameters
Summary
Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude larger than the request, allowing an unauthenticated remote attacker to exhaust server CPU and outbound network capacity with sustained low-volume traffic. Applications that do not bind request parameters to BigDecimal properties, or never render such a property through the Struts tag library, are not affected.
This issue affects Apache Struts: from 2.5.14 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.
Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 14:09 UTC
CWE
- CWE-405 - Asymmetric Resource Consumption (Amplification)
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cwiki.apache.org/confluence/display/WW/S2-076 | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Struts |
Affected:
2.5.14 , ≤ 2.5.33
(semver)
Affected: 6.0.0 , ≤ 6.11.0 (semver) Affected: 7.0.0 , ≤ 7.3.0 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-05T19:08:41.655Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/05/11"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-104712",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T14:09:49.658503Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T14:10:31.329Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.struts:struts2-core",
"packageURL": "pkg:maven/org.apache.struts/struts2-core",
"product": "Apache Struts",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.5.33",
"status": "affected",
"version": "2.5.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.0",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.3.0",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "0xCc.zhang"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude larger than the request, allowing an unauthenticated remote attacker to exhaust server CPU and outbound network capacity with sustained low-volume traffic. Applications that do not bind request parameters to BigDecimal properties, or never render such a property through the Struts tag library, are not affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache Struts: from 2.5.14 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."
}
],
"value": "Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal (java.math.BigDecimal) property that is then rendered through the Struts tag library, the framework can produce a response many orders of magnitude larger than the request, allowing an unauthenticated remote attacker to exhaust server CPU and outbound network capacity with sustained low-volume traffic. Applications that do not bind request parameters to BigDecimal properties, or never render such a property through the Struts tag library, are not affected.\n\nThis issue affects Apache Struts: from 2.5.14 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\n\nUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-405",
"description": "CWE-405 Asymmetric Resource Consumption (Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T18:35:41.767Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cwiki.apache.org/confluence/display/WW/S2-076"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Apache Struts: Disproportionate response size when rendering BigDecimal request parameters",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-104712",
"datePublished": "2026-10-05T18:35:41.767Z",
"dateReserved": "2026-10-02T10:54:11.636Z",
"dateUpdated": "2026-10-06T14:10:31.329Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104711 (GCVE-0-2026-104711)
Vulnerability from cvelistv5 – Published: 2026-10-05 18:35 – Updated: 2026-10-06 14:09
VLAI
EPSS
VEX
Title
Apache Struts: OGNL injection in the legacy RESTful action mapper
Summary
Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected.
This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.
Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 14:08 UTC
CWE
- CWE-917 - Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cwiki.apache.org/confluence/display/WW/S2-075 | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Struts |
Affected:
2.0.0 , ≤ 2.3.37
(semver)
Affected: 2.5.0 , ≤ 2.5.33 (semver) Affected: 6.0.0 , ≤ 6.11.0 (semver) Affected: 7.0.0 , ≤ 7.3.0 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-05T19:08:40.353Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/05/10"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-104711",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T14:08:35.909211Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T14:09:06.711Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.struts:struts2-core",
"packageURL": "pkg:maven/org.apache.struts/struts2-core",
"product": "Apache Struts",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.3.37",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "2.5.33",
"status": "affected",
"version": "2.5.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.0",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.3.0",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "LeaveSong"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper neutralization of special elements used in an expression language statement (\u0027Expression Language Injection\u0027) vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."
}
],
"value": "Improper neutralization of special elements used in an expression language statement (\u0027Expression Language Injection\u0027) vulnerability in Apache Struts. If the application is configured to use the legacy RESTful action mapper, a crafted request can inject an OGNL expression that may lead to remote code execution. Struts 7 is affected only when the OGNL allowlist is disabled; it is enabled by default. Applications using the default action mapper, the restful2 mapper, or the Struts REST plugin are not affected.\n\nThis issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\n\nUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-917",
"description": "CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement (\u0027Expression Language Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T18:35:10.026Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cwiki.apache.org/confluence/display/WW/S2-075"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Apache Struts: OGNL injection in the legacy RESTful action mapper",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-104711",
"datePublished": "2026-10-05T18:35:10.026Z",
"dateReserved": "2026-10-02T10:53:37.312Z",
"dateUpdated": "2026-10-06T14:09:06.711Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}