Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
5160 vulnerabilities by Apache Software Foundation
CVE-2026-97146 (GCVE-0-2026-97146)
Vulnerability from nvd – Published: 2026-10-07 09:16 – Updated: 2026-10-07 09:17
VLAI
EPSS
VEX
Title
Apache YuniKorn: Admission control bypass via system label forgery
Summary
Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the checks limiting the user annotation content are not run. The label is used to identify the YuniKorn application itself in the deployments.
The bypass allows any user to specify an arbitrary user info annotation. The arbitrary user information could allow access to a queue that the user normally would not have access to. Quota usage for the queue might be impacted if the application runs in the incorrect queue. User based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue.
Users are recommended to upgrade to version 1.10.0, which fixes this issue.
Severity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread.html/nds5ct9xzlo4… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache YuniKorn |
Affected:
0 , < 1.10.0
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T09:17:03.512Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/26"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://golang.org/pkg",
"defaultStatus": "unaffected",
"packageName": "github.com/apache/yunikorn-k8shim",
"packageURL": "pkg:golang/github.com/apache/yunikorn-k8shim",
"product": "Apache YuniKorn",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "1.10.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "mopmonk-ai@tophant.com"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod.\u0026nbsp;\u003cspan\u003eIf the pod has the label \u0027app=yunikorn\u0027 the checks \u003c/span\u003e\u003cspan\u003elimiting the user annotation content are not run. The label is used to identify the YuniKorn application itself in the deployments.\u003c/span\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThe bypass allows any user to specify an arbitrary user info annotation. The arbitrary user information\u0026nbsp;\u003cspan\u003ecould allow access to a queue that the user normally would not have access to.\u0026nbsp;\u003c/span\u003e\u003cspan\u003eQuota usage for the queue might be impacted if the application runs in the incorrect queue.\u0026nbsp;\u003c/span\u003e\u003cspan\u003eUser based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eUsers are recommended to upgrade to version 1.10.0, which fixes this issue.\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod.\u00a0If the pod has the label \u0027app=yunikorn\u0027 the checks limiting the user annotation content are not run. The label is used to identify the YuniKorn application itself in the deployments.\n\n\nThe bypass allows any user to specify an arbitrary user info annotation. The arbitrary user information\u00a0could allow access to a queue that the user normally would not have access to.\u00a0Quota usage for the queue might be impacted if the application runs in the incorrect queue.\u00a0User based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue.\n\n\n\n\nUsers are recommended to upgrade to version 1.10.0, which fixes this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T09:16:09.998Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/nds5ct9xzlo4fp0jfr1rx6jxm03g0jro"
}
],
"source": {
"advisory": "CWE-285: Improper Authorization",
"defect": [
"YUNIKORN-3472"
],
"discovery": "EXTERNAL"
},
"title": "Apache YuniKorn: Admission control bypass via system label forgery",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-97146",
"datePublished": "2026-10-07T09:16:09.998Z",
"dateReserved": "2026-09-24T01:13:32.307Z",
"dateUpdated": "2026-10-07T09:17:03.512Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92393 (GCVE-0-2026-92393)
Vulnerability from nvd – Published: 2026-10-07 09:15 – Updated: 2026-10-07 09:16
VLAI
EPSS
VEX
Title
Apache YuniKorn: Admission control bypass via workload UPDATE operation
Summary
Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined as the following Kubernetes objects: "deployments", "replicasets", "statefulsets", "daemonsets", "jobs", "cronjobs". The CREATE action correctly enforces the checks for all object types.
The bypass allows any user to specify an arbitrary user info annotation. The same bypass also allows changing the application ID for the workload. The combination of the two applied in one UPDATE could allow access to a queue that the user normally would not have access to. Quota usage for the queue might be impacted if the application runs in the incorrect queue. User based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue.
Users are recommended to upgrade to version 1.10.0, which fixes this issue.
Severity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread.html/sfo83zlrrx9f… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache YuniKorn |
Affected:
0 , < 1.10.0
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T09:16:13.149Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/25"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://golang.org/pkg",
"defaultStatus": "unaffected",
"packageName": "github.com/apache/yunikorn-k8shim",
"packageURL": "pkg:golang/github.com/apache/yunikorn-k8shim",
"product": "Apache YuniKorn",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "1.10.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "diana.wang.turing@gmail.com"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks.\u0026nbsp;\u003cspan\u003eWorkloads in YuniKorn are defined as the following Kubernetes objects: \"deployments\",\u0026nbsp;\u003c/span\u003e\u003cspan\u003e\"replicasets\", \"statefulsets\", \"daemonsets\", \"jobs\", \"cronjobs\".\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003cspan\u003eThe CREATE action correctly enforces the checks for all object types.\u003c/span\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003eThe bypass allows any user to specify an arbitrary user info annotation. The same bypass also allows changing the application ID for the workload. The combination of the two applied in one UPDATE\u0026nbsp;\u003cspan\u003ecould allow access to a queue that the user normally would not have access to.\u0026nbsp;\u003c/span\u003e\u003cspan\u003eQuota usage for the queue might be impacted if the application runs in the incorrect queue.\u0026nbsp;\u003c/span\u003e\u003cspan\u003eUser based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eUsers are recommended to upgrade to version 1.10.0, which fixes this issue.\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks.\u00a0Workloads in YuniKorn are defined as the following Kubernetes objects: \"deployments\",\u00a0\"replicasets\", \"statefulsets\", \"daemonsets\", \"jobs\", \"cronjobs\".\u00a0The CREATE action correctly enforces the checks for all object types.\n\n\nThe bypass allows any user to specify an arbitrary user info annotation. The same bypass also allows changing the application ID for the workload. The combination of the two applied in one UPDATE\u00a0could allow access to a queue that the user normally would not have access to.\u00a0Quota usage for the queue might be impacted if the application runs in the incorrect queue.\u00a0User based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue.\n\n\n\n\nUsers are recommended to upgrade to version 1.10.0, which fixes this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T09:15:31.679Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/sfo83zlrrx9ftbox9oxcp03qox2co449"
}
],
"source": {
"advisory": "CWE-285: Improper Authorization",
"defect": [
"YUNIKORN-3473"
],
"discovery": "EXTERNAL"
},
"title": "Apache YuniKorn: Admission control bypass via workload UPDATE operation",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-92393",
"datePublished": "2026-10-07T09:15:31.679Z",
"dateReserved": "2026-09-16T08:16:04.845Z",
"dateUpdated": "2026-10-07T09:16:13.149Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78243 (GCVE-0-2026-78243)
Vulnerability from nvd – Published: 2026-10-07 09:15 – Updated: 2026-10-07 10:13
VLAI
EPSS
VEX
Title
Apache YuniKorn: LDAP Group provider panics on lowercase attribute name
Summary
Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LDAP server returns a group membership entry, memberOf attribute, for a user specified in the pod the server crashes if a membership record does not start with "CN=".
This only affects install that have the non default LDAP group provider configured.
Users are recommended to upgrade to version 1.10.0, which fixes this issue.
Severity
CWE
- CWE-248 - Uncaught exception
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread.html/yz51lpj6k8q2… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache YuniKorn |
Affected:
1.8.0 , < 1.10.0
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T10:13:34.935Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/24"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://golang.org/pkg",
"defaultStatus": "unaffected",
"packageName": "github.com/apache/yunikorn-k8shim",
"packageURL": "pkg:golang/github.com/apache/yunikorn-k8shim",
"product": "Apache YuniKorn",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "1.10.0",
"status": "affected",
"version": "1.8.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "gjoko@zeroscience.mk"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.\u003cdiv\u003eIf the LDAP server returns a group membership entry, memberOf attribute, for a user specified in the pod the server crashes\u0026nbsp;\u003cspan\u003eif a membership record does not start with \"CN=\".\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThis only affects install that have the non default LDAP group provider configured.\u0026nbsp;\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003eUsers are recommended to upgrade to version 1.10.0, which fixes this issue.\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LDAP server returns a group membership entry, memberOf attribute, for a user specified in the pod the server crashes\u00a0if a membership record does not start with \"CN=\".\n\n\n\n\nThis only affects install that have the non default LDAP group provider configured.\u00a0\n\n\nUsers are recommended to upgrade to version 1.10.0, which fixes this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "AUTOMATIC",
"Safety": "NEGLIGIBLE",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "GREEN",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:N/R:A/V:D/RE:H/U:Green",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248 Uncaught exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T09:15:41.832Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/yz51lpj6k8q2hz7x2gjdpcrk44hdn25v"
}
],
"source": {
"advisory": "CWE-248: Uncaught Exception",
"defect": [
"YUNIKORN-3432"
],
"discovery": "EXTERNAL"
},
"title": "Apache YuniKorn: LDAP Group provider panics on lowercase attribute name",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-78243",
"datePublished": "2026-10-07T09:15:41.832Z",
"dateReserved": "2026-08-24T05:15:32.611Z",
"dateUpdated": "2026-10-07T10:13:34.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97720 (GCVE-0-2026-97720)
Vulnerability from nvd – Published: 2026-10-07 08:46 – Updated: 2026-10-07 09:17
VLAI
EPSS
VEX
Title
Apache Impala: Impala Executor Webserver Auth Bypass
Summary
Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token (JWT) signatures are not validated resulting in the webserver accepting any valid JWT.
Users are recommended to either disable JWT/OAuth auth for Impala executors or upgrade to version 4.5.3, which fixes this issue.
Severity
No CVSS data available.
CWE
- CWE-303 - Incorrect implementation of authentication algorithm
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread.html/q2qkrnko9hdv… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Impala |
Affected:
4.1.0 , ≤ 4.5.2
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T09:17:05.938Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/22"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache Impala",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.5.2",
"status": "affected",
"version": "4.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrew Rukin (Arenadata)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor\u0027s webserver when that webserver is configured to accept JWT/OAuth tokens.\u0026nbsp; Bearer token (JWT) signatures are not validated resulting in the webserver accepting any valid JWT.\u003cdiv\u003e\u003cbr\u003eUsers are recommended to either disable JWT/OAuth auth for Impala executors or upgrade to version 4.5.3, which fixes this issue.\u003c/div\u003e"
}
],
"value": "Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor\u0027s webserver when that webserver is configured to accept JWT/OAuth tokens.\u00a0 Bearer token (JWT) signatures are not validated resulting in the webserver accepting any valid JWT.\nUsers are recommended to either disable JWT/OAuth auth for Impala executors or upgrade to version 4.5.3, which fixes this issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-303",
"description": "CWE-303 Incorrect implementation of authentication algorithm",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T08:46:45.118Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/q2qkrnko9hdv2mhqy6prm06f65n2g3h2"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache Impala: Impala Executor Webserver Auth Bypass",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-97720",
"datePublished": "2026-10-07T08:46:45.118Z",
"dateReserved": "2026-09-24T23:33:41.006Z",
"dateUpdated": "2026-10-07T09:17:05.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93684 (GCVE-0-2026-93684)
Vulnerability from nvd – Published: 2026-10-07 08:48 – Updated: 2026-10-07 09:16
VLAI
EPSS
VEX
Title
Apache Impala: Stored XSS in Impala query plans
Summary
An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's browser when that user opens the query plan in Impala's Web UI. This is stored XSS (CWE-79). Users are recommended to upgrade to version 4.5.3.
Severity
No CVSS data available.
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread.html/qxjj5n3vsttx… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Impala |
Affected:
2.7.0 , ≤ 4.5.2
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T09:16:15.741Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/21"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache Impala",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.5.2",
"status": "affected",
"version": "2.7.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrew Rukin (Arenadata)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user\u0027s browser when that user opens the query plan in Impala\u0027s Web UI. This is\u0026nbsp;stored\u0026nbsp;XSS (CWE-79). Users are recommended to upgrade to version 4.5.3."
}
],
"value": "An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user\u0027s browser when that user opens the query plan in Impala\u0027s Web UI. This is\u00a0stored\u00a0XSS (CWE-79). Users are recommended to upgrade to version 4.5.3."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T08:48:45.195Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/qxjj5n3vsttxbvq2n75xcy2qcrhtxowx"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache Impala: Stored XSS in Impala query plans",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-93684",
"datePublished": "2026-10-07T08:48:45.195Z",
"dateReserved": "2026-09-18T14:25:05.651Z",
"dateUpdated": "2026-10-07T09:16:15.741Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90466 (GCVE-0-2026-90466)
Vulnerability from nvd – Published: 2026-10-07 08:47 – Updated: 2026-10-07 09:16
VLAI
EPSS
VEX
Title
Apache Impala: Path traversal executes JARs outside trusted paths
Summary
Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trusted_jar_paths'.
The startup flag 'trusted_jar_paths' references URIs for loading files from local or remote filesystems. Path traversal can't override the schema, but can result in loading a JAR that has been uploaded to a different location in that filesystem via Impala DDLs such as CREATE DATA SOURCE and CREATE TABLE. Path traversal can only be used if a trusted path exists, so this attack requires 'trusted_jar_paths' have a non-empty value configured by the Impala admin.
Users are recommended to upgrade to version 4.5.3, which fixes this issue.
Severity
No CVSS data available.
CWE
- CWE-23 - Relative path traversal
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread.html/m7qbho4j1g4v… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Impala |
Affected:
4.5.2 , < 4.5.3
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T09:16:10.802Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/20"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache Impala",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "4.5.3",
"status": "affected",
"version": "4.5.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Andrew Rukin (Arenadata)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003ePath traversal of \u0027trusted_jar_paths\u0027 in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in \u0027trusted_jar_paths\u0027.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThe startup flag \u0027trusted_jar_paths\u0027 references URIs for loading files from local or remote filesystems. Path traversal can\u0027t override the schema, but can result in loading a JAR that has been uploaded to a different location in that filesystem via Impala DDLs such as CREATE DATA SOURCE and CREATE TABLE. Path traversal can only be used if a trusted path exists, so this attack\u003cspan\u003e\u0026nbsp;requires \u0027trusted_jar_paths\u0027 have a non-empty value configured by the Impala admin.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eUsers are recommended to upgrade to version 4.5.3, which fixes this issue.\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "Path traversal of \u0027trusted_jar_paths\u0027 in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in \u0027trusted_jar_paths\u0027.\n\n\n\n\nThe startup flag \u0027trusted_jar_paths\u0027 references URIs for loading files from local or remote filesystems. Path traversal can\u0027t override the schema, but can result in loading a JAR that has been uploaded to a different location in that filesystem via Impala DDLs such as CREATE DATA SOURCE and CREATE TABLE. Path traversal can only be used if a trusted path exists, so this attack\u00a0requires \u0027trusted_jar_paths\u0027 have a non-empty value configured by the Impala admin.\n\n\n\n\nUsers are recommended to upgrade to version 4.5.3, which fixes this issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23 Relative path traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T08:47:12.542Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/m7qbho4j1g4v7kx7pbk4z2n8p9nx6bqn"
}
],
"source": {
"defect": [
"IMPALA-15345"
],
"discovery": "EXTERNAL"
},
"title": "Apache Impala: Path traversal executes JARs outside trusted paths",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-90466",
"datePublished": "2026-10-07T08:47:12.542Z",
"dateReserved": "2026-09-11T23:18:44.474Z",
"dateUpdated": "2026-10-07T09:16:10.802Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94114 (GCVE-0-2026-94114)
Vulnerability from nvd – Published: 2026-10-06 19:42 – Updated: 2026-10-07 06:12
VLAI
EPSS
VEX
Title
Apache Commons BCEL: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser
Summary
Symbolic name not mapping to correct object vulnerability in Apache Commons.
BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.
This issue affects Apache Commons: before 6.13.0.
Users are recommended to upgrade to version 6.13.0, which fixes the issue.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:59 UTC
CWE
- CWE-386 - Symbolic name not mapping to correct object
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Commons BCEL |
Affected:
0 , < 6.13.0
(maven)
Affected: 0 , < 14890bf2b9014df25f9b4de86f29b5e917e5656b (git) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94114",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:59:20.212043Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:59:30.889Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:12:16.240Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/12"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.bcel:bcel",
"packageURL": "pkg:maven/org.apache.bcel/bcel",
"product": "Apache Commons BCEL",
"repo": "https://gitbox.apache.org/repos/asf/commons-bcel.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "6.13.0",
"status": "affected",
"version": "0",
"versionType": "maven"
},
{
"lessThan": "14890bf2b9014df25f9b4de86f29b5e917e5656b",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSymbolic name not mapping to correct object vulnerability in Apache Commons.\u003c/p\u003e\u003cp\u003eBCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Commons: before 6.13.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 6.13.0, which fixes the issue.\u003c/p\u003e"
}
],
"value": "Symbolic name not mapping to correct object vulnerability in Apache Commons.\n\n\n\nBCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.\n\n\n\nThis issue affects Apache Commons: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-386",
"description": "CWE-386 Symbolic name not mapping to correct object",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:42:30.421Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b.patch"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/d87nxx7nb5bombqggxhxo9lz16nwtsf9"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache Commons BCEL: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-94114",
"datePublished": "2026-10-06T19:42:30.421Z",
"dateReserved": "2026-09-20T11:44:30.281Z",
"dateUpdated": "2026-10-07T06:12:16.240Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105244 (GCVE-0-2026-105244)
Vulnerability from nvd – Published: 2026-10-06 19:52 – Updated: 2026-10-07 06:12
VLAI
EPSS
VEX
Title
Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content
Summary
Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.
Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.
This issue affects Apache log4net: from 1.2.12 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Severity
5.3 (Medium)
CWE
- CWE-116 - Improper Encoding or Escaping of Output
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Affected:
1.2.12 , < 3.5.0
(semver)
|
|
| Apache Software Foundation | Apache log4net |
Affected:
56a2e146e21ff4737e1ff3ec308810e667873947 , < 77717061b20d4346b6c0ce6b54643d85fb348bc7
(git)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:12:01.025Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/19"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.12",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "77717061b20d4346b6c0ce6b54643d85fb348bc7",
"status": "affected",
"version": "56a2e146e21ff4737e1ff3ec308810e667873947",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.\u003cbr\u003e\u003cbr\u003eEvery character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.12 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.\n\nEvery character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.12 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:52:31.116Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/315"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/77717061b20d4346b6c0ce6b54643d85fb348bc7"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/q7649hhdodthoqw8jsjgtnb4m8qfy6d6"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105244",
"datePublished": "2026-10-06T19:52:31.116Z",
"dateReserved": "2026-10-04T16:22:18.416Z",
"dateUpdated": "2026-10-07T06:12:01.025Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105243 (GCVE-0-2026-105243)
Vulnerability from nvd – Published: 2026-10-06 19:51 – Updated: 2026-10-07 06:11
VLAI
EPSS
VEX
Title
Apache log4net: Oversize EventLogAppender record silently discarded
Summary
Insufficient Logging vulnerability in the EventLogAppender of Apache log4net.
Long messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough. Only applications on Windows that use EventLogAppender are affected.
This issue affects Apache log4net: from 1.2.9 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Severity
5.3 (Medium)
CWE
- CWE-778 - Insufficient Logging
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Affected:
1.2.9 , < 3.5.0
(semver)
|
|
| Apache Software Foundation | Apache log4net |
Affected:
02e1e115435888485f2e28b414d267e39e799e07 , < 28fbfb25678c48a8cc5bc9b94ead0dddfc39ffed
(git)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:11:59.799Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/17"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.9",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "28fbfb25678c48a8cc5bc9b94ead0dddfc39ffed",
"status": "affected",
"version": "02e1e115435888485f2e28b414d267e39e799e07",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insufficient Logging vulnerability in the EventLogAppender of Apache log4net.\u003cbr\u003e\u003cbr\u003eLong messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough. Only applications on Windows that use EventLogAppender are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Insufficient Logging vulnerability in the EventLogAppender of Apache log4net.\n\nLong messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough. Only applications on Windows that use EventLogAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-778",
"description": "CWE-778 Insufficient Logging",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:51:25.116Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/315"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/28fbfb25678c48a8cc5bc9b94ead0dddfc39ffed"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/jr6fj5skv1vnjbc9jmt8bp151p8ow1rp"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: Oversize EventLogAppender record silently discarded",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105243",
"datePublished": "2026-10-06T19:51:25.116Z",
"dateReserved": "2026-10-04T16:21:38.272Z",
"dateUpdated": "2026-10-07T06:11:59.799Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105242 (GCVE-0-2026-105242)
Vulnerability from nvd – Published: 2026-10-06 19:50 – Updated: 2026-10-07 06:11
VLAI
EPSS
VEX
Title
Apache log4net: Request validation failure drops the event in the aspnet-request converter
Summary
Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net.
Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request. Only applications on ASP.NET for .NET Framework whose layout uses %aspnet-request are affected.
This issue affects Apache log4net: from 1.2.11 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Severity
5.3 (Medium)
CWE
- CWE-755 - Improper Handling of Exceptional Conditions
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Affected:
1.2.11 , < 3.5.0
(semver)
|
|
| Apache Software Foundation | Apache log4net |
Affected:
243f1e9f3ee235955bade4b4fe664a903378719a , < 145203420c579a703008b4b723b6a080757f4964
(git)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:11:58.703Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/16"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.11",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "145203420c579a703008b4b723b6a080757f4964",
"status": "affected",
"version": "243f1e9f3ee235955bade4b4fe664a903378719a",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net.\u003cbr\u003e\u003cbr\u003eReading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request. Only applications on ASP.NET for .NET Framework whose layout uses %aspnet-request are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.11 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net.\n\nReading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request. Only applications on ASP.NET for .NET Framework whose layout uses %aspnet-request are affected.\n\nThis issue affects Apache log4net: from 1.2.11 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-755",
"description": "CWE-755 Improper Handling of Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:50:19.075Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/316"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/145203420c579a703008b4b723b6a080757f4964"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/zg6dbqm4ztm7j3c21nfsqj0yxm5yrpdx"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: Request validation failure drops the event in the aspnet-request converter",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105242",
"datePublished": "2026-10-06T19:50:19.075Z",
"dateReserved": "2026-10-04T16:21:12.546Z",
"dateUpdated": "2026-10-07T06:11:58.703Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105241 (GCVE-0-2026-105241)
Vulnerability from nvd – Published: 2026-10-06 19:49 – Updated: 2026-10-07 06:11
VLAI
EPSS
VEX
Title
Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch
Summary
Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net.
Content that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail could be left in the pickup directory. A party whose data reaches a log message could suppress the records of other events. Only applications that use SmtpPickupDirAppender are affected.
This issue affects Apache log4net: from 1.2.9 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Severity
5.3 (Medium)
CWE
- CWE-176 - Improper Handling of Unicode Encoding
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Affected:
1.2.9 , < 3.5.0
(semver)
|
|
| Apache Software Foundation | Apache log4net |
Affected:
02e1e115435888485f2e28b414d267e39e799e07 , < 4d2e10f0908199604b4326f9df6d0b43b871e333
(git)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:11:57.596Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/15"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.9",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "4d2e10f0908199604b4326f9df6d0b43b871e333",
"status": "affected",
"version": "02e1e115435888485f2e28b414d267e39e799e07",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net.\u003cbr\u003e\u003cbr\u003eContent that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail could be left in the pickup directory. A party whose data reaches a log message could suppress the records of other events. Only applications that use SmtpPickupDirAppender are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net.\n\nContent that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail could be left in the pickup directory. A party whose data reaches a log message could suppress the records of other events. Only applications that use SmtpPickupDirAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-176",
"description": "CWE-176 Improper Handling of Unicode Encoding",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:49:03.994Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/315"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/4d2e10f0908199604b4326f9df6d0b43b871e333"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/hg8dgh3oy8bp3dhb8nsygk9kw2o401ws"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105241",
"datePublished": "2026-10-06T19:49:03.994Z",
"dateReserved": "2026-10-04T16:20:44.036Z",
"dateUpdated": "2026-10-07T06:11:57.596Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105240 (GCVE-0-2026-105240)
Vulnerability from nvd – Published: 2026-10-06 19:47 – Updated: 2026-10-07 06:11
VLAI
EPSS
VEX
Title
Apache log4net: NUL character truncates OutputDebugStringAppender records
Summary
Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net.
A NUL character in logged content ended the debug output record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently lost. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use OutputDebugStringAppender are affected.
This issue affects Apache log4net: from 1.2.9 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Severity
5.3 (Medium)
CWE
- CWE-158 - Improper Neutralization of Null Byte or NUL Character
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Affected:
1.2.9 , < 3.5.0
(semver)
|
|
| Apache Software Foundation | Apache log4net |
Affected:
02e1e115435888485f2e28b414d267e39e799e07 , < 6046fe9d7f353b49fe995361c071ec2eea8f7ef6
(git)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:11:56.396Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/18"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.9",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "6046fe9d7f353b49fe995361c071ec2eea8f7ef6",
"status": "affected",
"version": "02e1e115435888485f2e28b414d267e39e799e07",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net.\u003cbr\u003e\u003cbr\u003eA NUL character in logged content ended the debug output record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently lost. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use OutputDebugStringAppender are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net.\n\nA NUL character in logged content ended the debug output record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently lost. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use OutputDebugStringAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-158",
"description": "CWE-158 Improper Neutralization of Null Byte or NUL Character",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:47:44.900Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/315"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/6046fe9d7f353b49fe995361c071ec2eea8f7ef6"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/gyw2d4ppy82t1vlpdknkfd1nmzp21z17"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: NUL character truncates OutputDebugStringAppender records",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105240",
"datePublished": "2026-10-06T19:47:44.900Z",
"dateReserved": "2026-10-04T16:20:07.533Z",
"dateUpdated": "2026-10-07T06:11:56.396Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105239 (GCVE-0-2026-105239)
Vulnerability from nvd – Published: 2026-10-06 19:46 – Updated: 2026-10-07 06:11
VLAI
EPSS
VEX
Title
Apache log4net: NUL character truncates EventLogAppender records
Summary
Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net.
A NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently not stored. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use EventLogAppender are affected.
This issue affects Apache log4net: from 1.2.9 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:58 UTC
CWE
- CWE-158 - Improper Neutralization of Null Byte or NUL Character
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Affected:
1.2.9 , < 3.5.0
(semver)
|
|
| Apache Software Foundation | Apache log4net |
Affected:
02e1e115435888485f2e28b414d267e39e799e07 , < dc5855a0720c91590fd7a81d729ea01fdd69e000
(git)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105239",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:58:19.202424Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:58:29.347Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:11:55.256Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/14"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.9",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "dc5855a0720c91590fd7a81d729ea01fdd69e000",
"status": "affected",
"version": "02e1e115435888485f2e28b414d267e39e799e07",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net.\u003cbr\u003e\u003cbr\u003eA NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently not stored. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use EventLogAppender are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net.\n\nA NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently not stored. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use EventLogAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-158",
"description": "CWE-158 Improper Neutralization of Null Byte or NUL Character",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:46:33.357Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/315"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/dc5855a0720c91590fd7a81d729ea01fdd69e000"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/9fx1qo5hc0tg8ym0t6p9gt1zpb2qlxpq"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: NUL character truncates EventLogAppender records",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105239",
"datePublished": "2026-10-06T19:46:33.357Z",
"dateReserved": "2026-10-04T16:19:29.460Z",
"dateUpdated": "2026-10-07T06:11:55.256Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105111 (GCVE-0-2026-105111)
Vulnerability from nvd – Published: 2026-10-06 19:44 – Updated: 2026-10-07 06:11
VLAI
EPSS
VEX
Title
Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS
Summary
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL.
This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports).
This issue affects Apache Commons BCEL: before 6.13.0.
Users are recommended to upgrade to version 6.13.0, which fixes the issue.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:58 UTC
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Commons BCEL |
Affected:
0 , < 6.13.0
(maven)
Affected: 0 , < fb72c225cbc6ec3d94060ed6edb269f07428d504 (git) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105111",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:58:48.850537Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:58:59.113Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:11:54.071Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/13"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.bcel:bcel",
"packageURL": "pkg:maven/org.apache.bcel/bcel",
"product": "Apache Commons BCEL",
"repo": "https://gitbox.apache.org/repos/asf/commons-bcel.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "6.13.0",
"status": "affected",
"version": "0",
"versionType": "maven"
},
{
"lessThan": "fb72c225cbc6ec3d94060ed6edb269f07428d504",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Apache Commons BCEL.\u003c/p\u003e\u003cp\u003eThis only happens when you\u0027re using \u003ccode\u003eClass2HTML\u003c/code\u003e to generate webpages for possibly-attacker-controlled class files, where \u003ccode\u003eClass2HTML\u003c/code\u003e emitters write attacker class-file strings into HTML unescaped (stored XSS in reports).\u003c/p\u003e\u003cp\u003eThis issue affects Apache Commons BCEL: before 6.13.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 6.13.0, which fixes the issue.\u003c/p\u003e"
}
],
"value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Apache Commons BCEL.\n\n\n\nThis only happens when you\u0027re using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports).\n\n\n\nThis issue affects Apache Commons BCEL: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:44:18.075Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/commons-bcel/commit/fb72c225cbc6ec3d94060ed6edb269f07428d504.patch"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/co1wfk2lyrmpnfhn49o370pvfl978rw6"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105111",
"datePublished": "2026-10-06T19:44:18.075Z",
"dateReserved": "2026-10-03T12:02:46.675Z",
"dateUpdated": "2026-10-07T06:11:54.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104714 (GCVE-0-2026-104714)
Vulnerability from nvd – Published: 2026-10-05 18:36 – Updated: 2026-10-06 14:13
VLAI
EPSS
VEX
Title
Apache Struts: Shared message formatter exposes date and time values across concurrent requests
Summary
Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user's response, or the rendering can fail and surface as a server error. Applications whose localized messages format no date or time arguments are not affected.
This issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.
Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 14:13 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cwiki.apache.org/confluence/display/WW/S2-078 | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Struts |
Affected:
2.0.0 , ≤ 2.3.37
(semver)
Affected: 2.5.0 , ≤ 2.5.33 (semver) Affected: 6.0.0 , ≤ 6.11.0 (semver) Affected: 7.0.0 , ≤ 7.3.0 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-05T19:08:44.251Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/05/13"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-104714",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T14:13:22.832050Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T14:13:46.615Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.struts:struts2-core",
"packageURL": "pkg:maven/org.apache.struts/struts2-core",
"product": "Apache Struts",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.3.37",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "2.5.33",
"status": "affected",
"version": "2.5.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.0",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.3.0",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "n0mi1k"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Concurrent execution using shared resource with improper synchronization (\u0027race condition\u0027) vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user\u0027s response, or the rendering can fail and surface as a server error. Applications whose localized messages format no date or time arguments are not affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."
}
],
"value": "Concurrent execution using shared resource with improper synchronization (\u0027race condition\u0027) vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that message by the application-wide text provider is used by concurrently served requests without isolation, so a value belonging to one user can appear in another user\u0027s response, or the rendering can fail and surface as a server error. Applications whose localized messages format no date or time arguments are not affected.\n\nThis issue affects Apache Struts: from 2.0.0 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\n\nUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T18:36:49.472Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cwiki.apache.org/confluence/display/WW/S2-078"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Apache Struts: Shared message formatter exposes date and time values across concurrent requests",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-104714",
"datePublished": "2026-10-05T18:36:49.472Z",
"dateReserved": "2026-10-02T10:55:01.052Z",
"dateUpdated": "2026-10-06T14:13:46.615Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-104713 (GCVE-0-2026-104713)
Vulnerability from nvd – Published: 2026-10-05 18:36 – Updated: 2026-10-06 14:12
VLAI
EPSS
VEX
Title
Apache Struts: Unbounded request body read in the REST plugin
Summary
Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap and denying service to other users. No additional setting has to be enabled. Applications that do not use the REST plugin are not affected.
This issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.
Users are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 14:11 UTC
CWE
- CWE-770 - Allocation of Resources Without Limits or Throttling
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://cwiki.apache.org/confluence/display/WW/S2-077 | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Struts |
Affected:
2.1.8 , ≤ 2.3.37
(semver)
Affected: 2.5.0 , ≤ 2.5.33 (semver) Affected: 6.0.0 , ≤ 6.11.0 (semver) Affected: 7.0.0 , ≤ 7.3.0 (semver) |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-05T19:08:42.973Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/05/12"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-104713",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T14:11:48.988162Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T14:12:55.065Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.struts:struts2-rest-plugin",
"packageURL": "pkg:maven/org.apache.struts/struts2-rest-plugin",
"product": "Apache Struts",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "2.3.37",
"status": "affected",
"version": "2.1.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "2.5.33",
"status": "affected",
"version": "2.5.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.11.0",
"status": "affected",
"version": "6.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.3.0",
"status": "affected",
"version": "7.0.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "n0mi1k"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap and denying service to other users. No additional setting has to be enabled. Applications that do not use the REST plugin are not affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."
}
],
"value": "Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on how much will be accepted, so a single request can cause the server to allocate memory in proportion to its size, exhausting the Java heap and denying service to other users. No additional setting has to be enabled. Applications that do not use the REST plugin are not affected.\n\nThis issue affects Apache Struts: from 2.1.8 through 2.3.37, from 2.5.0 through 2.5.33, from 6.0.0 through 6.11.0, from 7.0.0 through 7.3.0.\n\nUsers are recommended to upgrade to version 6.12.0 or 7.4.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770 Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-05T18:36:09.420Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://cwiki.apache.org/confluence/display/WW/S2-077"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Apache Struts: Unbounded request body read in the REST plugin",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-104713",
"datePublished": "2026-10-05T18:36:09.420Z",
"dateReserved": "2026-10-02T10:54:35.480Z",
"dateUpdated": "2026-10-06T14:12:55.065Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97146 (GCVE-0-2026-97146)
Vulnerability from cvelistv5 – Published: 2026-10-07 09:16 – Updated: 2026-10-07 09:17
VLAI
EPSS
VEX
Title
Apache YuniKorn: Admission control bypass via system label forgery
Summary
Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the label 'app=yunikorn' the checks limiting the user annotation content are not run. The label is used to identify the YuniKorn application itself in the deployments.
The bypass allows any user to specify an arbitrary user info annotation. The arbitrary user information could allow access to a queue that the user normally would not have access to. Quota usage for the queue might be impacted if the application runs in the incorrect queue. User based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue.
Users are recommended to upgrade to version 1.10.0, which fixes this issue.
Severity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread.html/nds5ct9xzlo4… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache YuniKorn |
Affected:
0 , < 1.10.0
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T09:17:03.512Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/26"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://golang.org/pkg",
"defaultStatus": "unaffected",
"packageName": "github.com/apache/yunikorn-k8shim",
"packageURL": "pkg:golang/github.com/apache/yunikorn-k8shim",
"product": "Apache YuniKorn",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "1.10.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "mopmonk-ai@tophant.com"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod.\u0026nbsp;\u003cspan\u003eIf the pod has the label \u0027app=yunikorn\u0027 the checks \u003c/span\u003e\u003cspan\u003elimiting the user annotation content are not run. The label is used to identify the YuniKorn application itself in the deployments.\u003c/span\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThe bypass allows any user to specify an arbitrary user info annotation. The arbitrary user information\u0026nbsp;\u003cspan\u003ecould allow access to a queue that the user normally would not have access to.\u0026nbsp;\u003c/span\u003e\u003cspan\u003eQuota usage for the queue might be impacted if the application runs in the incorrect queue.\u0026nbsp;\u003c/span\u003e\u003cspan\u003eUser based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eUsers are recommended to upgrade to version 1.10.0, which fixes this issue.\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Apache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod.\u00a0If the pod has the label \u0027app=yunikorn\u0027 the checks limiting the user annotation content are not run. The label is used to identify the YuniKorn application itself in the deployments.\n\n\nThe bypass allows any user to specify an arbitrary user info annotation. The arbitrary user information\u00a0could allow access to a queue that the user normally would not have access to.\u00a0Quota usage for the queue might be impacted if the application runs in the incorrect queue.\u00a0User based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue.\n\n\n\n\nUsers are recommended to upgrade to version 1.10.0, which fixes this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T09:16:09.998Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/nds5ct9xzlo4fp0jfr1rx6jxm03g0jro"
}
],
"source": {
"advisory": "CWE-285: Improper Authorization",
"defect": [
"YUNIKORN-3472"
],
"discovery": "EXTERNAL"
},
"title": "Apache YuniKorn: Admission control bypass via system label forgery",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-97146",
"datePublished": "2026-10-07T09:16:09.998Z",
"dateReserved": "2026-09-24T01:13:32.307Z",
"dateUpdated": "2026-10-07T09:17:03.512Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78243 (GCVE-0-2026-78243)
Vulnerability from cvelistv5 – Published: 2026-10-07 09:15 – Updated: 2026-10-07 10:13
VLAI
EPSS
VEX
Title
Apache YuniKorn: LDAP Group provider panics on lowercase attribute name
Summary
Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LDAP server returns a group membership entry, memberOf attribute, for a user specified in the pod the server crashes if a membership record does not start with "CN=".
This only affects install that have the non default LDAP group provider configured.
Users are recommended to upgrade to version 1.10.0, which fixes this issue.
Severity
CWE
- CWE-248 - Uncaught exception
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread.html/yz51lpj6k8q2… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache YuniKorn |
Affected:
1.8.0 , < 1.10.0
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T10:13:34.935Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/24"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://golang.org/pkg",
"defaultStatus": "unaffected",
"packageName": "github.com/apache/yunikorn-k8shim",
"packageURL": "pkg:golang/github.com/apache/yunikorn-k8shim",
"product": "Apache YuniKorn",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "1.10.0",
"status": "affected",
"version": "1.8.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "gjoko@zeroscience.mk"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.\u003cdiv\u003eIf the LDAP server returns a group membership entry, memberOf attribute, for a user specified in the pod the server crashes\u0026nbsp;\u003cspan\u003eif a membership record does not start with \"CN=\".\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThis only affects install that have the non default LDAP group provider configured.\u0026nbsp;\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003eUsers are recommended to upgrade to version 1.10.0, which fixes this issue.\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership entries.If the LDAP server returns a group membership entry, memberOf attribute, for a user specified in the pod the server crashes\u00a0if a membership record does not start with \"CN=\".\n\n\n\n\nThis only affects install that have the non default LDAP group provider configured.\u00a0\n\n\nUsers are recommended to upgrade to version 1.10.0, which fixes this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "AUTOMATIC",
"Safety": "NEGLIGIBLE",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "GREEN",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/S:N/AU:N/R:A/V:D/RE:H/U:Green",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248 Uncaught exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T09:15:41.832Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/yz51lpj6k8q2hz7x2gjdpcrk44hdn25v"
}
],
"source": {
"advisory": "CWE-248: Uncaught Exception",
"defect": [
"YUNIKORN-3432"
],
"discovery": "EXTERNAL"
},
"title": "Apache YuniKorn: LDAP Group provider panics on lowercase attribute name",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-78243",
"datePublished": "2026-10-07T09:15:41.832Z",
"dateReserved": "2026-08-24T05:15:32.611Z",
"dateUpdated": "2026-10-07T10:13:34.935Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92393 (GCVE-0-2026-92393)
Vulnerability from cvelistv5 – Published: 2026-10-07 09:15 – Updated: 2026-10-07 09:16
VLAI
EPSS
VEX
Title
Apache YuniKorn: Admission control bypass via workload UPDATE operation
Summary
Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined as the following Kubernetes objects: "deployments", "replicasets", "statefulsets", "daemonsets", "jobs", "cronjobs". The CREATE action correctly enforces the checks for all object types.
The bypass allows any user to specify an arbitrary user info annotation. The same bypass also allows changing the application ID for the workload. The combination of the two applied in one UPDATE could allow access to a queue that the user normally would not have access to. Quota usage for the queue might be impacted if the application runs in the incorrect queue. User based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue.
Users are recommended to upgrade to version 1.10.0, which fixes this issue.
Severity
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread.html/sfo83zlrrx9f… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache YuniKorn |
Affected:
0 , < 1.10.0
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T09:16:13.149Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/25"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://golang.org/pkg",
"defaultStatus": "unaffected",
"packageName": "github.com/apache/yunikorn-k8shim",
"packageURL": "pkg:golang/github.com/apache/yunikorn-k8shim",
"product": "Apache YuniKorn",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "1.10.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "diana.wang.turing@gmail.com"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks.\u0026nbsp;\u003cspan\u003eWorkloads in YuniKorn are defined as the following Kubernetes objects: \"deployments\",\u0026nbsp;\u003c/span\u003e\u003cspan\u003e\"replicasets\", \"statefulsets\", \"daemonsets\", \"jobs\", \"cronjobs\".\u003c/span\u003e\u003cspan\u003e\u0026nbsp;\u003c/span\u003e\u003cspan\u003eThe CREATE action correctly enforces the checks for all object types.\u003c/span\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003e\u003cdiv\u003eThe bypass allows any user to specify an arbitrary user info annotation. The same bypass also allows changing the application ID for the workload. The combination of the two applied in one UPDATE\u0026nbsp;\u003cspan\u003ecould allow access to a queue that the user normally would not have access to.\u0026nbsp;\u003c/span\u003e\u003cspan\u003eQuota usage for the queue might be impacted if the application runs in the incorrect queue.\u0026nbsp;\u003c/span\u003e\u003cspan\u003eUser based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eUsers are recommended to upgrade to version 1.10.0, which fixes this issue.\u003c/div\u003e\u003c/div\u003e"
}
],
"value": "Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks.\u00a0Workloads in YuniKorn are defined as the following Kubernetes objects: \"deployments\",\u00a0\"replicasets\", \"statefulsets\", \"daemonsets\", \"jobs\", \"cronjobs\".\u00a0The CREATE action correctly enforces the checks for all object types.\n\n\nThe bypass allows any user to specify an arbitrary user info annotation. The same bypass also allows changing the application ID for the workload. The combination of the two applied in one UPDATE\u00a0could allow access to a queue that the user normally would not have access to.\u00a0Quota usage for the queue might be impacted if the application runs in the incorrect queue.\u00a0User based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue.\n\n\n\n\nUsers are recommended to upgrade to version 1.10.0, which fixes this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T09:15:31.679Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/sfo83zlrrx9ftbox9oxcp03qox2co449"
}
],
"source": {
"advisory": "CWE-285: Improper Authorization",
"defect": [
"YUNIKORN-3473"
],
"discovery": "EXTERNAL"
},
"title": "Apache YuniKorn: Admission control bypass via workload UPDATE operation",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-92393",
"datePublished": "2026-10-07T09:15:31.679Z",
"dateReserved": "2026-09-16T08:16:04.845Z",
"dateUpdated": "2026-10-07T09:16:13.149Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-93684 (GCVE-0-2026-93684)
Vulnerability from cvelistv5 – Published: 2026-10-07 08:48 – Updated: 2026-10-07 09:16
VLAI
EPSS
VEX
Title
Apache Impala: Stored XSS in Impala query plans
Summary
An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's browser when that user opens the query plan in Impala's Web UI. This is stored XSS (CWE-79). Users are recommended to upgrade to version 4.5.3.
Severity
No CVSS data available.
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread.html/qxjj5n3vsttx… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Impala |
Affected:
2.7.0 , ≤ 4.5.2
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T09:16:15.741Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/21"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache Impala",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.5.2",
"status": "affected",
"version": "2.7.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrew Rukin (Arenadata)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user\u0027s browser when that user opens the query plan in Impala\u0027s Web UI. This is\u0026nbsp;stored\u0026nbsp;XSS (CWE-79). Users are recommended to upgrade to version 4.5.3."
}
],
"value": "An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user\u0027s browser when that user opens the query plan in Impala\u0027s Web UI. This is\u00a0stored\u00a0XSS (CWE-79). Users are recommended to upgrade to version 4.5.3."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T08:48:45.195Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/qxjj5n3vsttxbvq2n75xcy2qcrhtxowx"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache Impala: Stored XSS in Impala query plans",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-93684",
"datePublished": "2026-10-07T08:48:45.195Z",
"dateReserved": "2026-09-18T14:25:05.651Z",
"dateUpdated": "2026-10-07T09:16:15.741Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90466 (GCVE-0-2026-90466)
Vulnerability from cvelistv5 – Published: 2026-10-07 08:47 – Updated: 2026-10-07 09:16
VLAI
EPSS
VEX
Title
Apache Impala: Path traversal executes JARs outside trusted paths
Summary
Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trusted_jar_paths'.
The startup flag 'trusted_jar_paths' references URIs for loading files from local or remote filesystems. Path traversal can't override the schema, but can result in loading a JAR that has been uploaded to a different location in that filesystem via Impala DDLs such as CREATE DATA SOURCE and CREATE TABLE. Path traversal can only be used if a trusted path exists, so this attack requires 'trusted_jar_paths' have a non-empty value configured by the Impala admin.
Users are recommended to upgrade to version 4.5.3, which fixes this issue.
Severity
No CVSS data available.
CWE
- CWE-23 - Relative path traversal
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread.html/m7qbho4j1g4v… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Impala |
Affected:
4.5.2 , < 4.5.3
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T09:16:10.802Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/20"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache Impala",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "4.5.3",
"status": "affected",
"version": "4.5.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Andrew Rukin (Arenadata)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003ePath traversal of \u0027trusted_jar_paths\u0027 in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in \u0027trusted_jar_paths\u0027.\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eThe startup flag \u0027trusted_jar_paths\u0027 references URIs for loading files from local or remote filesystems. Path traversal can\u0027t override the schema, but can result in loading a JAR that has been uploaded to a different location in that filesystem via Impala DDLs such as CREATE DATA SOURCE and CREATE TABLE. Path traversal can only be used if a trusted path exists, so this attack\u003cspan\u003e\u0026nbsp;requires \u0027trusted_jar_paths\u0027 have a non-empty value configured by the Impala admin.\u003c/span\u003e\u003c/div\u003e\u003cdiv\u003e\u003cbr\u003e\u003c/div\u003e\u003cdiv\u003eUsers are recommended to upgrade to version 4.5.3, which fixes this issue.\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "Path traversal of \u0027trusted_jar_paths\u0027 in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in \u0027trusted_jar_paths\u0027.\n\n\n\n\nThe startup flag \u0027trusted_jar_paths\u0027 references URIs for loading files from local or remote filesystems. Path traversal can\u0027t override the schema, but can result in loading a JAR that has been uploaded to a different location in that filesystem via Impala DDLs such as CREATE DATA SOURCE and CREATE TABLE. Path traversal can only be used if a trusted path exists, so this attack\u00a0requires \u0027trusted_jar_paths\u0027 have a non-empty value configured by the Impala admin.\n\n\n\n\nUsers are recommended to upgrade to version 4.5.3, which fixes this issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23 Relative path traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T08:47:12.542Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/m7qbho4j1g4v7kx7pbk4z2n8p9nx6bqn"
}
],
"source": {
"defect": [
"IMPALA-15345"
],
"discovery": "EXTERNAL"
},
"title": "Apache Impala: Path traversal executes JARs outside trusted paths",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-90466",
"datePublished": "2026-10-07T08:47:12.542Z",
"dateReserved": "2026-09-11T23:18:44.474Z",
"dateUpdated": "2026-10-07T09:16:10.802Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-97720 (GCVE-0-2026-97720)
Vulnerability from cvelistv5 – Published: 2026-10-07 08:46 – Updated: 2026-10-07 09:17
VLAI
EPSS
VEX
Title
Apache Impala: Impala Executor Webserver Auth Bypass
Summary
Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor's webserver when that webserver is configured to accept JWT/OAuth tokens. Bearer token (JWT) signatures are not validated resulting in the webserver accepting any valid JWT.
Users are recommended to either disable JWT/OAuth auth for Impala executors or upgrade to version 4.5.3, which fixes this issue.
Severity
No CVSS data available.
CWE
- CWE-303 - Incorrect implementation of authentication algorithm
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://lists.apache.org/thread.html/q2qkrnko9hdv… | vendor-advisory |
| http://www.openwall.com/lists/oss-security/2026/1… |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Impala |
Affected:
4.1.0 , ≤ 4.5.2
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T09:17:05.938Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/22"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Apache Impala",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThanOrEqual": "4.5.2",
"status": "affected",
"version": "4.1.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrew Rukin (Arenadata)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor\u0027s webserver when that webserver is configured to accept JWT/OAuth tokens.\u0026nbsp; Bearer token (JWT) signatures are not validated resulting in the webserver accepting any valid JWT.\u003cdiv\u003e\u003cbr\u003eUsers are recommended to either disable JWT/OAuth auth for Impala executors or upgrade to version 4.5.3, which fixes this issue.\u003c/div\u003e"
}
],
"value": "Incorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to access resources served by the executor\u0027s webserver when that webserver is configured to accept JWT/OAuth tokens.\u00a0 Bearer token (JWT) signatures are not validated resulting in the webserver accepting any valid JWT.\nUsers are recommended to either disable JWT/OAuth auth for Impala executors or upgrade to version 4.5.3, which fixes this issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-303",
"description": "CWE-303 Incorrect implementation of authentication algorithm",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T08:46:45.118Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/q2qkrnko9hdv2mhqy6prm06f65n2g3h2"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Apache Impala: Impala Executor Webserver Auth Bypass",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-97720",
"datePublished": "2026-10-07T08:46:45.118Z",
"dateReserved": "2026-09-24T23:33:41.006Z",
"dateUpdated": "2026-10-07T09:17:05.938Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105244 (GCVE-0-2026-105244)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:52 – Updated: 2026-10-07 06:12
VLAI
EPSS
VEX
Title
Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content
Summary
Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.
Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.
This issue affects Apache log4net: from 1.2.12 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Severity
5.3 (Medium)
CWE
- CWE-116 - Improper Encoding or Escaping of Output
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Affected:
1.2.12 , < 3.5.0
(semver)
|
|
| Apache Software Foundation | Apache log4net |
Affected:
56a2e146e21ff4737e1ff3ec308810e667873947 , < 77717061b20d4346b6c0ce6b54643d85fb348bc7
(git)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:12:01.025Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/19"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.12",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "77717061b20d4346b6c0ce6b54643d85fb348bc7",
"status": "affected",
"version": "56a2e146e21ff4737e1ff3ec308810e667873947",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.\u003cbr\u003e\u003cbr\u003eEvery character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.12 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.\n\nEvery character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.12 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:52:31.116Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/315"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/77717061b20d4346b6c0ce6b54643d85fb348bc7"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/q7649hhdodthoqw8jsjgtnb4m8qfy6d6"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: RemoteSyslogAppender silently deletes non-ASCII content",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105244",
"datePublished": "2026-10-06T19:52:31.116Z",
"dateReserved": "2026-10-04T16:22:18.416Z",
"dateUpdated": "2026-10-07T06:12:01.025Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105243 (GCVE-0-2026-105243)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:51 – Updated: 2026-10-07 06:11
VLAI
EPSS
VEX
Title
Apache log4net: Oversize EventLogAppender record silently discarded
Summary
Insufficient Logging vulnerability in the EventLogAppender of Apache log4net.
Long messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough. Only applications on Windows that use EventLogAppender are affected.
This issue affects Apache log4net: from 1.2.9 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Severity
5.3 (Medium)
CWE
- CWE-778 - Insufficient Logging
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Affected:
1.2.9 , < 3.5.0
(semver)
|
|
| Apache Software Foundation | Apache log4net |
Affected:
02e1e115435888485f2e28b414d267e39e799e07 , < 28fbfb25678c48a8cc5bc9b94ead0dddfc39ffed
(git)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:11:59.799Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/17"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.9",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "28fbfb25678c48a8cc5bc9b94ead0dddfc39ffed",
"status": "affected",
"version": "02e1e115435888485f2e28b414d267e39e799e07",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Insufficient Logging vulnerability in the EventLogAppender of Apache log4net.\u003cbr\u003e\u003cbr\u003eLong messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough. Only applications on Windows that use EventLogAppender are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Insufficient Logging vulnerability in the EventLogAppender of Apache log4net.\n\nLong messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough. Only applications on Windows that use EventLogAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-778",
"description": "CWE-778 Insufficient Logging",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:51:25.116Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/315"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/28fbfb25678c48a8cc5bc9b94ead0dddfc39ffed"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/jr6fj5skv1vnjbc9jmt8bp151p8ow1rp"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: Oversize EventLogAppender record silently discarded",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105243",
"datePublished": "2026-10-06T19:51:25.116Z",
"dateReserved": "2026-10-04T16:21:38.272Z",
"dateUpdated": "2026-10-07T06:11:59.799Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105242 (GCVE-0-2026-105242)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:50 – Updated: 2026-10-07 06:11
VLAI
EPSS
VEX
Title
Apache log4net: Request validation failure drops the event in the aspnet-request converter
Summary
Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net.
Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request. Only applications on ASP.NET for .NET Framework whose layout uses %aspnet-request are affected.
This issue affects Apache log4net: from 1.2.11 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Severity
5.3 (Medium)
CWE
- CWE-755 - Improper Handling of Exceptional Conditions
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Affected:
1.2.11 , < 3.5.0
(semver)
|
|
| Apache Software Foundation | Apache log4net |
Affected:
243f1e9f3ee235955bade4b4fe664a903378719a , < 145203420c579a703008b4b723b6a080757f4964
(git)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:11:58.703Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/16"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.11",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "145203420c579a703008b4b723b6a080757f4964",
"status": "affected",
"version": "243f1e9f3ee235955bade4b4fe664a903378719a",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net.\u003cbr\u003e\u003cbr\u003eReading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request. Only applications on ASP.NET for .NET Framework whose layout uses %aspnet-request are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.11 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net.\n\nReading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request. Only applications on ASP.NET for .NET Framework whose layout uses %aspnet-request are affected.\n\nThis issue affects Apache log4net: from 1.2.11 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-755",
"description": "CWE-755 Improper Handling of Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:50:19.075Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/316"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/145203420c579a703008b4b723b6a080757f4964"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/zg6dbqm4ztm7j3c21nfsqj0yxm5yrpdx"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: Request validation failure drops the event in the aspnet-request converter",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105242",
"datePublished": "2026-10-06T19:50:19.075Z",
"dateReserved": "2026-10-04T16:21:12.546Z",
"dateUpdated": "2026-10-07T06:11:58.703Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105241 (GCVE-0-2026-105241)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:49 – Updated: 2026-10-07 06:11
VLAI
EPSS
VEX
Title
Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch
Summary
Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net.
Content that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail could be left in the pickup directory. A party whose data reaches a log message could suppress the records of other events. Only applications that use SmtpPickupDirAppender are affected.
This issue affects Apache log4net: from 1.2.9 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Severity
5.3 (Medium)
CWE
- CWE-176 - Improper Handling of Unicode Encoding
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Affected:
1.2.9 , < 3.5.0
(semver)
|
|
| Apache Software Foundation | Apache log4net |
Affected:
02e1e115435888485f2e28b414d267e39e799e07 , < 4d2e10f0908199604b4326f9df6d0b43b871e333
(git)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:11:57.596Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/15"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.9",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "4d2e10f0908199604b4326f9df6d0b43b871e333",
"status": "affected",
"version": "02e1e115435888485f2e28b414d267e39e799e07",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net.\u003cbr\u003e\u003cbr\u003eContent that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail could be left in the pickup directory. A party whose data reaches a log message could suppress the records of other events. Only applications that use SmtpPickupDirAppender are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net.\n\nContent that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail could be left in the pickup directory. A party whose data reaches a log message could suppress the records of other events. Only applications that use SmtpPickupDirAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-176",
"description": "CWE-176 Improper Handling of Unicode Encoding",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:49:03.994Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/315"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/4d2e10f0908199604b4326f9df6d0b43b871e333"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/hg8dgh3oy8bp3dhb8nsygk9kw2o401ws"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105241",
"datePublished": "2026-10-06T19:49:03.994Z",
"dateReserved": "2026-10-04T16:20:44.036Z",
"dateUpdated": "2026-10-07T06:11:57.596Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105240 (GCVE-0-2026-105240)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:47 – Updated: 2026-10-07 06:11
VLAI
EPSS
VEX
Title
Apache log4net: NUL character truncates OutputDebugStringAppender records
Summary
Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net.
A NUL character in logged content ended the debug output record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently lost. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use OutputDebugStringAppender are affected.
This issue affects Apache log4net: from 1.2.9 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Severity
5.3 (Medium)
CWE
- CWE-158 - Improper Neutralization of Null Byte or NUL Character
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Affected:
1.2.9 , < 3.5.0
(semver)
|
|
| Apache Software Foundation | Apache log4net |
Affected:
02e1e115435888485f2e28b414d267e39e799e07 , < 6046fe9d7f353b49fe995361c071ec2eea8f7ef6
(git)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:11:56.396Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/18"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.9",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "6046fe9d7f353b49fe995361c071ec2eea8f7ef6",
"status": "affected",
"version": "02e1e115435888485f2e28b414d267e39e799e07",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net.\u003cbr\u003e\u003cbr\u003eA NUL character in logged content ended the debug output record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently lost. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use OutputDebugStringAppender are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net.\n\nA NUL character in logged content ended the debug output record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently lost. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use OutputDebugStringAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-158",
"description": "CWE-158 Improper Neutralization of Null Byte or NUL Character",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:47:44.900Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/315"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/6046fe9d7f353b49fe995361c071ec2eea8f7ef6"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/gyw2d4ppy82t1vlpdknkfd1nmzp21z17"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: NUL character truncates OutputDebugStringAppender records",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105240",
"datePublished": "2026-10-06T19:47:44.900Z",
"dateReserved": "2026-10-04T16:20:07.533Z",
"dateUpdated": "2026-10-07T06:11:56.396Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105239 (GCVE-0-2026-105239)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:46 – Updated: 2026-10-07 06:11
VLAI
EPSS
VEX
Title
Apache log4net: NUL character truncates EventLogAppender records
Summary
Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net.
A NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently not stored. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use EventLogAppender are affected.
This issue affects Apache log4net: from 1.2.9 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:58 UTC
CWE
- CWE-158 - Improper Neutralization of Null Byte or NUL Character
Assigner
References
4 references
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache log4net |
Affected:
1.2.9 , < 3.5.0
(semver)
|
|
| Apache Software Foundation | Apache log4net |
Affected:
02e1e115435888485f2e28b414d267e39e799e07 , < dc5855a0720c91590fd7a81d729ea01fdd69e000
(git)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105239",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:58:19.202424Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:58:29.347Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:11:55.256Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/14"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "3.5.0",
"status": "affected",
"version": "1.2.9",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://nuget.org/packages",
"defaultStatus": "unaffected",
"packageName": "log4net",
"packageURL": "pkg:nuget/log4net",
"product": "Apache log4net",
"repo": "https://gitbox.apache.org/repos/asf/logging-log4net.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "dc5855a0720c91590fd7a81d729ea01fdd69e000",
"status": "affected",
"version": "02e1e115435888485f2e28b414d267e39e799e07",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Jan Friedrich"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net.\u003cbr\u003e\u003cbr\u003eA NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently not stored. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use EventLogAppender are affected.\u003cbr\u003e\u003cbr\u003eThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\u003cbr\u003e\u003cbr\u003eUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"value": "Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net.\n\nA NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently not stored. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use EventLogAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue."
}
],
"metrics": [
{
"other": {
"content": {
"text": "moderate"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-158",
"description": "CWE-158 Improper Neutralization of Null Byte or NUL Character",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:46:33.357Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/pull/315"
},
{
"tags": [
"patch"
],
"url": "https://github.com/apache/logging-log4net/commit/dc5855a0720c91590fd7a81d729ea01fdd69e000"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/9fx1qo5hc0tg8ym0t6p9gt1zpb2qlxpq"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache log4net: NUL character truncates EventLogAppender records",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105239",
"datePublished": "2026-10-06T19:46:33.357Z",
"dateReserved": "2026-10-04T16:19:29.460Z",
"dateUpdated": "2026-10-07T06:11:55.256Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105111 (GCVE-0-2026-105111)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:44 – Updated: 2026-10-07 06:11
VLAI
EPSS
VEX
Title
Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS
Summary
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL.
This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports).
This issue affects Apache Commons BCEL: before 6.13.0.
Users are recommended to upgrade to version 6.13.0, which fixes the issue.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:58 UTC
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Commons BCEL |
Affected:
0 , < 6.13.0
(maven)
Affected: 0 , < fb72c225cbc6ec3d94060ed6edb269f07428d504 (git) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105111",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:58:48.850537Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:58:59.113Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:11:54.071Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/13"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.bcel:bcel",
"packageURL": "pkg:maven/org.apache.bcel/bcel",
"product": "Apache Commons BCEL",
"repo": "https://gitbox.apache.org/repos/asf/commons-bcel.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "6.13.0",
"status": "affected",
"version": "0",
"versionType": "maven"
},
{
"lessThan": "fb72c225cbc6ec3d94060ed6edb269f07428d504",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Apache Commons BCEL.\u003c/p\u003e\u003cp\u003eThis only happens when you\u0027re using \u003ccode\u003eClass2HTML\u003c/code\u003e to generate webpages for possibly-attacker-controlled class files, where \u003ccode\u003eClass2HTML\u003c/code\u003e emitters write attacker class-file strings into HTML unescaped (stored XSS in reports).\u003c/p\u003e\u003cp\u003eThis issue affects Apache Commons BCEL: before 6.13.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 6.13.0, which fixes the issue.\u003c/p\u003e"
}
],
"value": "Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027) vulnerability in Apache Commons BCEL.\n\n\n\nThis only happens when you\u0027re using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports).\n\n\n\nThis issue affects Apache Commons BCEL: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"other": {
"content": {
"text": "low"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:44:18.075Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/commons-bcel/commit/fb72c225cbc6ec3d94060ed6edb269f07428d504.patch"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/co1wfk2lyrmpnfhn49o370pvfl978rw6"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-105111",
"datePublished": "2026-10-06T19:44:18.075Z",
"dateReserved": "2026-10-03T12:02:46.675Z",
"dateUpdated": "2026-10-07T06:11:54.071Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94114 (GCVE-0-2026-94114)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:42 – Updated: 2026-10-07 06:12
VLAI
EPSS
VEX
Title
Apache Commons BCEL: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser
Summary
Symbolic name not mapping to correct object vulnerability in Apache Commons.
BCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.
This issue affects Apache Commons: before 6.13.0.
Users are recommended to upgrade to version 6.13.0, which fixes the issue.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:59 UTC
CWE
- CWE-386 - Symbolic name not mapping to correct object
Assigner
References
3 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Apache Software Foundation | Apache Commons BCEL |
Affected:
0 , < 6.13.0
(maven)
Affected: 0 , < 14890bf2b9014df25f9b4de86f29b5e917e5656b (git) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94114",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:59:20.212043Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:59:30.889Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-10-07T06:12:16.240Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/10/07/12"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://repo.maven.apache.org/maven2",
"defaultStatus": "unaffected",
"packageName": "org.apache.bcel:bcel",
"packageURL": "pkg:maven/org.apache.bcel/bcel",
"product": "Apache Commons BCEL",
"repo": "https://gitbox.apache.org/repos/asf/commons-bcel.git",
"vendor": "Apache Software Foundation",
"versions": [
{
"lessThan": "6.13.0",
"status": "affected",
"version": "0",
"versionType": "maven"
},
{
"lessThan": "14890bf2b9014df25f9b4de86f29b5e917e5656b",
"status": "affected",
"version": "0",
"versionType": "git"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "The Apache Software Foundation"
},
{
"lang": "en",
"type": "tool",
"value": "Claude Security"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eSymbolic name not mapping to correct object vulnerability in Apache Commons.\u003c/p\u003e\u003cp\u003eBCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.\u003c/p\u003e\u003cp\u003eThis issue affects Apache Commons: before 6.13.0.\u003c/p\u003e\u003cp\u003eUsers are recommended to upgrade to version 6.13.0, which fixes the issue.\u003c/p\u003e"
}
],
"value": "Symbolic name not mapping to correct object vulnerability in Apache Commons.\n\n\n\nBCEL caches attacker-controlled classes under their self-declared names without validating the requested name, allowing subsequent lookups and name-keyed verification results to refer to a different class.\n\n\n\nThis issue affects Apache Commons: before 6.13.0.\n\n\n\nUsers are recommended to upgrade to version 6.13.0, which fixes the issue."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"other": {
"content": {
"text": "important"
},
"type": "Textual description of severity"
},
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-386",
"description": "CWE-386 Symbolic name not mapping to correct object",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:42:30.421Z",
"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"shortName": "apache"
},
"references": [
{
"tags": [
"patch"
],
"url": "https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b.patch"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://lists.apache.org/thread.html/d87nxx7nb5bombqggxhxo9lz16nwtsf9"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Apache Commons BCEL: Nested Code/Record attributes drive unbounded parse-time recursion in ClassParser",
"x_generator": {
"engine": "Vulnogram 1.0.3"
}
}
},
"cveMetadata": {
"assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
"assignerShortName": "apache",
"cveId": "CVE-2026-94114",
"datePublished": "2026-10-06T19:42:30.421Z",
"dateReserved": "2026-09-20T11:44:30.281Z",
"dateUpdated": "2026-10-07T06:12:16.240Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}