Back Linuxsecurity

Fedora 44 NAnt Important Log4net DoS Risk Advisory 2026

Linuxsecurity •LinuxSecurity Advisories • October 16, 2026

Share: View original

Running self-managed GitLab? Critical flaws could allow server code execution. Check the fixes. ×

NAnt is a free .NET build tool. In theory it is kind of like make

without make's wrinkles. In practice it's a lot like Ant.

Update log4net to 3.5.0. Nant is rebuilt (only dependency in Fedora).

* Wed Oct 7 2026 Tom Callaway - 1:0.92-43 - rebuild for new log4net * Thu Jul 16 2026 Fedora Release Engineering - 1:0.92-42 - Rebuilt for

[ 1 ] Bug #2457917 - CVE-2026-40021 log4net: Apache Log4net: Denial of Service for logging via unsanitized XML characters [fedora-all] [ 2 ] Bug #2547384 - CVE-2026-105241 log4net: log4net: Log event suppression via improper Unicode handling in SmtpPickupDirAppender [fedora-all] [ 3 ] Bug #2547386 - CVE-2026-105242 log4net: log4net: Audit log suppression via crafted request parameters [fedora-all] [ 4 ] Bug #2547388 - CVE-2026-105244 log4net: log4net: Log manipulation via improper character escaping in RemoteSyslogAppender [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-0bf84c3130' at the command line. For more information, refer to the dnf documentation available at

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fedora 43 and 44 log4net and NAnt Denial of Service Vulnerabilities Multiple Denial of Service vulnerabilities have been identified in log4net and NAnt affecting Fedora 43 and 44. The vulnerabilities include CVE-2026-40021, published on April 10, 2026, which allows for logging denial of service via unsanitized XML characters, and three additional CVEs (CVE-2026-105241, CVE-2026-105242, CVE-2026-105244) published on October 6, 2026, related to log event suppression and log manipulation. Users of self-managed GitLab and systems running Fedora are urged to update log4net to version 3.5.0 and NAnt to the latest rebuild to mitigate these risks. The updates are available through the 'dnf' package manager. The vulnerabilities could allow attackers to manipulate logs or suppress logging, potentially impacting system monitoring and security. Current advisories recommend immediate action to patch affected systems. 4 sources 46

Extracted Entities

Attack Types (1)

Denial of Service

CVEs (4)

CVE-2026-105241 CVE-2026-105242 CVE-2026-105244 CVE-2026-40021