Back Linuxsecurity

Fedora 44 log4net Update Critical Denial of Service Issues 2026

Linuxsecurity •LinuxSecurity Advisories • October 16, 2026

Share: View original

Running self-managed GitLab? Critical flaws could allow server code execution. Check the fixes. ×

log4net is a tool to help the programmer output log statements to a

variety of output targets. log4net is a port of the excellent log4j

framework to the .NET runtime

Update log4net to 3.5.0. Nant is rebuilt (only dependency in Fedora).

* Wed Oct 7 2026 Tom Callaway 3.5.0-1 - update to 3.5.0 * Thu Jul 16 2026 Fedora Release Engineering - 2.0.8-25 - Rebuilt for

[ 1 ] Bug #2457917 - CVE-2026-40021 log4net: Apache Log4net: Denial of Service for logging via unsanitized XML characters [fedora-all] [ 2 ] Bug #2547384 - CVE-2026-105241 log4net: log4net: Log event suppression via improper Unicode handling in SmtpPickupDirAppender [fedora-all] [ 3 ] Bug #2547386 - CVE-2026-105242 log4net: log4net: Audit log suppression via crafted request parameters [fedora-all] [ 4 ] Bug #2547388 - CVE-2026-105244 log4net: log4net: Log manipulation via improper character escaping in RemoteSyslogAppender [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-0bf84c3130' at the command line. For more information, refer to the dnf documentation available at

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora 43 and 44 log4net and NAnt Denial of Service Vulnerabilities Multiple Denial of Service vulnerabilities have been identified in log4net and NAnt affecting Fedora 43 and 44. The vulnerabilities include CVE-2026-40021, published on April 10, 2026, which allows for logging denial of service via unsanitized XML characters, and three additional CVEs (CVE-2026-105241, CVE-2026-105242, CVE-2026-105244) published on October 6, 2026, related to log event suppression and log manipulation. Users of self-managed GitLab and systems running Fedora are urged to update log4net to version 3.5.0 and NAnt to the latest rebuild to mitigate these risks. The updates are available through the 'dnf' package manager. The vulnerabilities could allow attackers to manipulate logs or suppress logging, potentially impacting system monitoring and security. Current advisories recommend immediate action to patch affected systems. 4 sources 46

Extracted Entities

Fedora 44 log4net Update Critical Denial of Service Issues 2026

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (4)

Platforms (1)