Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-105241

Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache…

Risk score
43/100
CVSS
5.3 v3.1
Exploit chance (30 days)
0.8%
Published
6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail c…
Affected
Apache log4net before 3.5.0
Fix
Upgrade Apache log4net to 3.5.0 or later.
Exploitation
No known exploitation

Story map

Story map: Apache log4netTHE FLAWSTHE FIXCVE-2026-105241Improper Handling of UnicodeEncoding vulnerability in theSmtpPickupDirAppender of…CVSS 5.3 · EPSS 1%CVE-2026-105239Improper Neutralization ofNull Byte or NUL Charactervulnerability in the…CVSS 5.3 · EPSS 1%CVE-2026-105242Improper Handling ofExceptional Conditionsvulnerability in the…CVSS 5.3 · EPSS 1%CVE-2026-105244Improper Encoding or Escapingof Output vulnerability in theRemoteSyslogAppender of…CVSS 5.3 · EPSS 1%Upgrade Apache log4net3.5.0or later on your release lineWho is exposedApache log4net before 3.5.0YELLOW · PLAN IT INApache log4netImproper Handling of UnicodeEncoding vulnerability in theSmtpPickupDirAppender ofApache log4net. Content thatthe mail file writer cannotencode, such as an unpairedUTF-16 surrogate, made the…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-176 (CWE-176)4 other warnings in 30 days →Same productEarlier Apache log4net warnings2 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Apache log4net: Yellow, plan it in. Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail c…

The flaws

  • CVE-2026-105241: Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache… (CVSS 5.3 · EPSS 1%)
  • CVE-2026-105239: Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of… (CVSS 5.3 · EPSS 1%)
  • CVE-2026-105242: Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter… (CVSS 5.3 · EPSS 1%)
  • CVE-2026-105244: Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache… (CVSS 5.3 · EPSS 1%)

The fix

Upgrade Apache log4net: 3.5.0 or later on your release line

Who is exposed: Apache log4net before 3.5.0

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 5.3 medium

References

Original description

Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail could be left in the pickup directory. A party whose data reaches a log message could suppress the records of other events. Only applications that use SmtpPickupDirAppender are affected. This issue affects Apache log4net: from 1.2.9 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.

Last activity 6 Oct 2026. Patch Forecast updates every hour.