CVE-2026-40021: Apache Log4net log suppression in XmlLayout

Executive brief

Apache Log4net fails to sanitize XML-forbidden characters in certain fields, leading to serialization exceptions and silent loss of log events.

Affected products

• Apache log4net
• NuGet log4net

References

• https://api.github.com/users/FreeAndNil
• https://github.com/FreeAndNil
• https://api.github.com/users/FreeAndNil/gists%7B/gist_id%7D
• https://api.github.com/users/FreeAndNil/repos
• https://avatars.githubusercontent.com/u/43271715?v=4
• https://api.github.com/users/FreeAndNil/events%7B/privacy%7D