Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files.

Summary

Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files.

Timeline

1. May 11, 2020, 4:41 PM UTCCVE published
2. Aug 5, 2024, 3:59 AM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a Apache log4net

  Apache log4net up to 2.0.8

• log4netNuGet

  fixed in 2.0.10

References 18