CVE-2026-40021 Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters

[
  {
    "collectionURL": "https://www.nuget.org/packages",
    "cpes": [
      "cpe:2.3:a:apache:log4net:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "packageName": "log4net",
    "packageURL": "pkg:nuget/log4net",
    "product": "Apache Log4net",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "3.3.0",
        "status": "affected",
        "version": "0",
        "versionType": "nuget"
      }
    ]
  }
]