CVE-2026-105244

Executive Summary

CVE-2026-105244 is an improper output encoding/escaping vulnerability (CWE-116) in the RemoteSyslogAppender component of Apache log4net. Every character outside visible ASCII and the space character is stripped from the log record instead of being escaped, so non-ASCII text and control characters (for example, tabs) silently disappear; an attacker who can influence log-message content can make one distinct value render identically to another (e.g., a username containing a zero-width space being logged as admin). Only applications that use RemoteSyslogAppender are affected; the issue affects Apache log4net versions from 1.2.12 before 3.5.0, and users should upgrade to 3.5.0.

Technical Analysis

The vulnerability resides in RemoteSyslogAppender, a log4net appender that forwards log events to a remote syslog receiver (typically over UDP/TCP port 514 or an RFC 5424/3164 transport). The core defect is a sanitization routine that removes rather than escapes characters that are not visible ASCII or a space. Two consequences follow directly from the description:

1. Lossy normalization, not escaping. Because the appender deletes non-ASCII and control characters (including tabs) instead of outputting an escaped representation, the resulting syslog record is not a faithful encoding of the original log event. Any semantic content carried by those removed characters is destroyed without any indication that removal occurred.
2. Collision / impersonation of log fields. A party whose data reaches a log message can craft input containing invisible or non-ASCII characters such that, after stripping, the logged value is indistinguishable from a legitimate value. The NVD example is concrete: a user name containing a zero-width space is logged simply as admin. In a syslog record, admin (attacker-controlled, with an injected zero-width space) and admin (the genuine privileged account) become byte-for-byte identical.

This is an injection-by-normalization weakness rather than a classic injection: the appender does not permit arbitrary characters to reach the log line (they are removed), but it permits an attacker to erase the distinguishing bytes between two logically different values. The attack surface is therefore any application that (a) uses RemoteSyslogAppender and (b) allows attacker-controlled data (usernames, HTTP headers, form fields, identifiers, filenames) to flow into a log message routed through this appender.

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (5.3 Medium) reflects a network-reachable, low-complexity, unauthenticated flaw with no user interaction, no confidentiality impact, no availability impact, and only a low integrity impact — consistent with the limited scope of corrupting the fidelity of one log field rather than compromising the host.

No public proof-of-concept, exploit code, or Nuclei template exists for this CVE at the time of writing. CISA KEV does not list it, and it has not been scored by FIRST.org (EPSS unavailable). The analysis below is derived strictly from the vulnerability class and the vendor description; no specific function names, parameters, or code paths beyond RemoteSyslogAppender are asserted.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-116, output encoding/escaping) and the vendor description. All named entities (RemoteSyslogAppender, admin) are taken verbatim from the NVD text.

1. Reconnaissance / target identification. An adversary identifies an application that uses Apache log4net (affected range 1.2.12 to < 3.5.0) and specifically routes its logs through RemoteSyslogAppender. This can be inferred from application behavior, dependency manifests, error output containing log4net references, or knowledge of the target's logging architecture. The goal is to confirm that attacker-influenced input is written into log messages that traverse this appender.

2. Triggering the flaw class. The attacker supplies input containing characters outside visible ASCII and space — for example, a zero-width space or a tab — through any field that the application logs (a user name, an identifier, a header value, or a similar data element). Because the appender removes these characters instead of escaping them, the byte sequence is silently deleted before the record is forwarded to the remote syslog server.

3. Payload / execution method. At the vulnerability-class level, the "payload" is not executable code but a manipulation of the log record's content: an attacker-chosen value is crafted so that after non-ASCII/control characters are stripped, the logged result is identical to a different, trusted value. The documented example is a user name containing a zero-width space that is logged as admin. The technique is normalization-based impersonation of a log field.

4. Post-exploitation impact. By making attacker-controlled activity appear to originate from a legitimate identity (e.g., admin), the adversary degrades the integrity and trustworthiness of the syslog record. This can mislead incident responders, corrupt audit trails, and complicate attribution, and it aligns with MITRE ATT&CK T1070 (Indicator Removal) in the sense of undermining log integrity and forensic value. There is no confidentiality or availability impact, consistent with the CVSS vector.

Important caveat: the exploitability is bounded to applications using RemoteSyslogAppender; applications using other appenders are not affected by this specific defect.

Impact Assessment

The CVSS v3.1 base score is 5.3 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N:

• Attack Vector (AV:N — Network): reachable over the network; log data can be influenced remotely by any party whose data is logged.
• Attack Complexity (AC:L — Low): no special conditions beyond the presence of RemoteSyslogAppender and attacker-influenced data in a log message.
• Privileges Required (PR:N — None): no prior authentication is required to introduce the crafted input.
• User Interaction (UI:N — None): no victim action beyond normal logging.
• Scope (S:U — Unchanged): the impact is confined to the logging component; there is no evidence of cross-boundary privilege escalation.
• Confidentiality (C:N — None): no data disclosure.
• Integrity (I:L — Low): the fidelity of log records is compromised — records can omit characters and, critically, misattribute events to a different identity.
• Availability (A:N — None): no denial of service.

Business impact: The primary harm is to audit integrity, forensic accuracy, and security-monitoring trust. In regulated environments (PCI DSS, HIPAA, SOC 2, ISO 27001) where log integrity underpins compliance, the silent corruption and potential impersonation of identities within syslog records can cause investigations to reach incorrect conclusions. The blast radius is limited to deployments that use RemoteSyslogAppender; the utility is not remotely exploitable in a code-execution sense. There is no known active exploitation, no KEV listing, and no EPSS score at this time, so the operational urgency is driven by the logging-integrity use case rather than an imminent exploitation wave.

Detection Guidance

Because the flaw does not produce a distinctive network signature of a compromise but rather subtly alters legitimate log content, detection focuses on monitoring for characters that vanish and on anomalous identity collisions in syslog.

Sigma Rule

title: Potential Apache log4net RemoteSyslogAppender Log Field Manipulation
id: 9f3c2a10-7b4e-4f1c-9a2d-log4net116
status: experimental
description: Detects log records where an identity or privileged field may have had invisible/non-ASCII characters stripped, allowing impersonation (CVE-2026-105244).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105244
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: syslog
detection:
  selection_appender:
    message|contains:
      - 'RemoteSyslogAppender'
  selection_privileged_identity:
    message|re: '(user|username|account|principal)=(admin|root|administrator|system)\b'
  condition: selection_appender and selection_privileged_identity
fields:
  - message
  - host
  - user
falsepositives:
  - Legitimate administrative activity logged by privileged accounts
level: low

YARA Rule

rule CVE_2026_105244_log4net_RemoteSyslogAppender
{
    meta:
        description = "Detects Apache log4net versions potentially affected by RemoteSyslogAppender output encoding issue (CVE-2026-105244)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105244"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $appender = "RemoteSyslogAppender" ascii wide
        $log4net  = "log4net" ascii wide nocase
        $cfg1     = "appender name=" ascii wide

    condition:
        $log4net and $appender and $cfg1
}

Suricata IDS Rule

alert udp any any -> any 514 (msg:"CVE-2026-105244 Apache log4net RemoteSyslogAppender abnormal non-ASCII stripped log record"; flow:to_server; content:"log4net"; nocase; pcre:"/<[0-9]{3}>[^\\x09]{0,1024}(user|username|account)=(admin|root)\\b/i"; reference:cve,2026-105244; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-105244; classtype:policy-violation; sid:2026105244; rev:1;)

Elastic Detection

sequence by host.id with maxspan=5m
  [process where process.name != null and process.args : "*log4net*" and process.command_line : "*RemoteSyslogAppender*"]
  [file where file.path != null and file.name : ("*.log" or "*.syslog") and file.Ext.header_bytes : "*admin*"]

Splunk SPL Query

index=syslog (sourcetype=syslog OR sourcetype=log4net)
| search "RemoteSyslogAppender" OR "log4net"
| rex field=_raw "(?<field_name>user(name)?|account|principal)=(?<field_value>\S+)"
| where match(field_value, "^(admin|root|administrator|system)$")
| stats count min(_time) as first_seen max(_time) as last_seen values(field_value) as value by host, field_name
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="log4net,cve-2026-105244,">
  <rule id="105244" level="4">
    <decoded_as>syslog</decoded_as>
    <match>RemoteSyslogAppender</match>
    <description>CVE-2026-105244: Apache log4net RemoteSyslogAppender log record referencing privileged identity - possible log field impersonation (admin).</description>
    <group>log_integrity,</group>
  </rule>
  <rule id="105245" level="6">
    <if_sid>105244</if_sid>
    <regex>(user|username|account)=(admin|root|administrator|system)\b</regex>
    <description>CVE-2026-105244: Potentially spoofed privileged identity in log4net RemoteSyslogAppender output.</description>
    <group>log_integrity,impersonation,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). There is no vendor fix or workaround evidence in the tracked sources; the vendor advisory states that upgrading to log4net 3.5.0 fixes the issue.

1. Immediate mitigations

   • Determine whether any managed application uses log4net in the affected range (1.2.12 to < 3.5.0) and configures RemoteSyslogAppender. Only those deployments are exposed.
   • Where RemoteSyslogAppender is not strictly required, switch to an appender that performs proper escaping, or temporarily avoid forwarding attacker-influenced fields verbatim.
   • Restrict who can inject data that flows into logged fields, and enforce strict allow-listing (e.g., rejecting zero-width and other non-ASCII characters) at the input layer before values are logged.
   • Treat syslog records from affected appenders as lower-trust for identity attribution pending upgrade (log integrity caveat).

2. Patch / upgrade steps

   • Upgrade Apache log4net to 3.5.0, which the vendor states fixes the issue.
   • Confirm no application assembles logs via an affected intermediate that still routes through a pre-3.5.0 RemoteSyslogAppender.
   • Validate post-upgrade that non-ASCII and control characters are now escaped/preserved rather than silently deleted, and re-baseline log-normalization expectations.

3. Long-term hardening

   • Track log4net as a security-relevant dependency via SBOM and dependency-scanning tooling, since logging libraries have a history of security-relevant defects.
   • Adopt log-integrity controls: cryptographically signed or tamper-evident log pipelines, and normalization/validation at the log-ingest boundary rather than removal at the source.
   • Enforce Unicode normalization and character-class validation on identity fields so that visually/bytewise colliding values (e.g., zero-width space vs. plain text) cannot occur.
   • Continuously monitor vendor advisories for log4net and the Apache security mailing list for follow-ups on this CVE, including any updated patch-confirmation data.

References

• NVD — CVE-2026-105244: https://nvd.nist.gov/vuln/detail/CVE-2026-105244
• CWE-116 — Improper Encoding or Escaping of Output: https://cwe.mitre.org/data/definitions/116.html
• Apache log4net (project/downloads; upgrade target version 3.5.0): https://logging.apache.org/log4net/
• Apache Software Foundation security advisories: https://logging.apache.org/security.html
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat-actor campaigns or exploit-in-the-wild evidence were identified for CVE-2026-105244 in the provided data; no public PoC, exploit code, or Nuclei template exists, and the CVE is not in CISA KEV.