Fix: Remote Denial of Service (Infinite Loop) in TelnetAppender

[OxBat]

Summary

I identified a critical robustness issue in TelnetAppender where logging a message shorter than 4 characters (e.g., "OK", "404") triggers an infinite loop, causing 100% CPU usage on the worker thread.

Technical Analysis

The vulnerability is caused by a logic mismatch between the memory allocation strategy in TelnetAppender and the safety requirements of the UTF8CharsetEncoder.

1. Vulnerable Allocation (telnetappender.cpp):
   The buffer is allocated dynamically based strictly on message length:

   size_t bytesSize = msg.size() * 2;

For a 2-byte message ("Hi"), the allocated buffer is 4 bytes.

2. Blocker Guard (charsetencoder.cpp): The UTF8CharsetEncoder enforces a safety check requiring at least 8 bytes of remaining space:

   if (out.remaining() >= 8) { ... }

If the buffer is smaller, it returns APR_SUCCESS without consuming input or advancing the iterator.

3. The Infinite Loop: TelnetAppender receives a success code but detects the message hasn't been fully processed (msgIter != msg.end()). It retries the loop indefinitely with the same insufficient buffer, creating a deadlock.

Remediation
This patch modifies TelnetAppender::append to enforce a minimum buffer allocation (1024 bytes). This ensures the buffer always satisfies the encoder's requirements, preventing the infinite loop regardless of the input message length.

Threat Model Context
While this requires an untrusted log event, it results in a high-severity availability impact (Thread Hang).

[rm5248]

Thanks for your contribution. Since you have opened several PRs, would you mind signing an ICLA if you have not done so already?

[OxBat]

Hello, ​Thank you! I am filling out the ICLA right now and will email it to ***@***.*** today. ​I will let you know once it has been sent. ​Best regards, Le mer. 28 janv. 2026, 00:41, Robert Middleton ***@***.***> a écrit :

…

*rm5248* left a comment (apache/logging-log4cxx#583) <#583 (comment)> Thanks for your contribution. Since you have opened several PRs, would you mind signing an ICLA <https://www.apache.org/licenses/contributor-agreements.html> if you have not done so already? — Reply to this email directly, view it on GitHub <#583 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ATDCZXIEKUEXBMBMZNIZCLD4I7ZRHAVCNFSM6AAAAACTB22SWWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTQMBYGEZTGMZWGE> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[OxBat]

@rm5248
Just a quick update. I received the confirmation from the ASF Secretary today. My ICLA is officially filed and recorde. ty