Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

loggingredactor may cause crashes when logging numbers

CVE-2026-22041 · published 10 months ago
Summary

The loggingredactor Python library (armanjasuja/loggingredactor and armurox/logging_redactor) changes non‑text data into text before writing logs, which can trigger errors when numeric values are formatted. This can stop logging or crash applications that rely on it. Upgrade to version 0.0.6 or later, where the issue is fixed.

What to do
  • Update arman jasuja loggingredactor to version 0.0.6.
  • Update armurox logging_redactor to version 0.0.6 or later.
Affected software
Ecosystem VendorProductAffected versions
pip arman jasuja loggingredactor < 0.0.6
Fix: upgrade to 0.0.6
– armurox logging_redactor < 0.0.6
cpe:2.3:a:armurox:logging_redactor:*:*:*:*:*:python:*:*
Original advisory text
loggingredactor converts non-string types to string types in logs
Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to version 0.0.6, non-string types are converted into string types, leading to type errors in %d conversions. The problem has been patched in version 0.0.6. No known workarounds are available.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-704Incorrect Type Conversion or Cast
Timeline
Published8 Jan 2026
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-rvjx-cfjh-5mc9 · GHSA
CVE-2026-22041 · NVD
CVE-2026-22041 · OSV
Track software like this
Free during beta