Skip to content
Fedora 43 and 44 log4net and NAnt Denial of Service Vulnerabilities

Fedora 43 and 44 log4net and NAnt Denial of Service Vulnerabilities

First seen 17 Oct 2026, 16:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 17, 2026 at 20:48 UTC
  • •Critical Denial of Service vulnerabilities in log4net and NAnt affect Fedora 43 and 44.
  • •Four CVEs identified, with CVE-2026-40021 published on April 10, 2026, and others on October 6, 2026.
  • •Users must update to log4net 3.5.0 and NAnt's latest rebuild to mitigate risks.

Multiple Denial of Service vulnerabilities have been identified in log4net and NAnt affecting Fedora 43 and 44. The vulnerabilities include CVE-2026-40021, published on April 10, 2026, which allows for logging denial of service via unsanitized XML characters, and three additional CVEs (CVE-2026-105241, CVE-2026-105242, CVE-2026-105244) published on October 6, 2026, related to log event suppression and log manipulation. Users of self-managed GitLab and systems running Fedora are urged to update log4net to version 3.5.0 and NAnt to the latest rebuild to mitigate these risks. The updates are available through the 'dnf' package manager. The vulnerabilities could allow attackers to manipulate logs or suppress logging, potentially impacting system monitoring and security. Current advisories recommend immediate action to patch affected systems.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-04-10
CVE-2026-40021 published
CVE-2026-40021 allows Denial of Service via unsanitized XML characters in log4net.
Linuxsecurity
2026-10-06
CVE-2026-105241, 105242, 105244 published
Three additional CVEs related to log manipulation and event suppression in log4net were published.
Linuxsecurity
2026-10-06
CVE-2026-105242 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-06
CVE-2026-105244 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-07
log4net updated to 3.5.0
Fedora released an update to log4net to address the identified vulnerabilities.
Linuxsecurity
2026-10-07
NAnt rebuilt for new log4net
NAnt was rebuilt in Fedora to align with the updated log4net version.
Linuxsecurity

More articles in this cluster (4)

Following this threat?

Track Fedora and CVE-2026-105241 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (10)

1 / 2

Common questions

Which versions are affected?
Fedora 43 and 44 are affected due to vulnerabilities in log4net and NAnt.
Is there an active exploit?
No active exploitation has been reported; however, vulnerabilities are confirmed and require patching.
What should I do to protect my systems?
Update log4net to version 3.5.0 and rebuild NAnt as recommended in the advisories.