CVE-2026-105243: medium-severity vulnerability in Apache log4net
Apache log4net: Oversize EventLogAppender record silently discarded
Published · Updated
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.3%
exploitation probability
0.3%top 76% of all CVEs
observed exploitation
nono source reports it
Insufficient Logging vulnerability in the EventLogAppender of Apache log4net.
Long messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough. Only applications on Windows that use EventLogAppender are affected.
This issue affects Apache log4net: from 1.2.9 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Apache Software Foundation · Apache log4netRelated CVEs — Apache log4net
In the same product, most dangerous first.
CVE-2026-105244MEDIUMApache log4net: RemoteSyslogAppender silently deletes non-ASCII contentEPSS 0.3%CVE-2026-105242MEDIUMApache log4net: Request validation failure drops the event in the aspnet-request converterEPSS 0.3%CVE-2026-105241MEDIUMApache log4net: Unencodable content discards a whole SmtpPickupDirAppender batchEPSS 0.3%CVE-2026-105239MEDIUMApache log4net: NUL character truncates EventLogAppender recordsEPSS 0.3%CVE-2026-105240MEDIUMApache log4net: NUL character truncates OutputDebugStringAppender recordsEPSS 0.3%