Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-105243

Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were…

Risk score
43/100
CVSS
5.3 v3.1
Exploit chance (30 days)
0.8%
Published
6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message coul…
Affected
Apache log4net before 3.5.0
Fix
Upgrade Apache log4net to 3.5.0 or later.
Exploitation
No known exploitation

Story map

Story map: Apache log4netTHE FLAWSTHE FIXCVE-2026-105243Insufficient Loggingvulnerability in theEventLogAppender of Apache…CVSS 5.3 · EPSS 1%CVE-2026-105239Improper Neutralization ofNull Byte or NUL Charactervulnerability in the…CVSS 5.3 · EPSS 1%CVE-2026-105241Improper Handling of UnicodeEncoding vulnerability in theSmtpPickupDirAppender of…CVSS 5.3 · EPSS 1%CVE-2026-105242Improper Handling ofExceptional Conditionsvulnerability in the…CVSS 5.3 · EPSS 1%Upgrade Apache log4net3.5.0or later on your release lineWho is exposedApache log4net before 3.5.0YELLOW · PLAN IT INApache log4netImproper Neutralization of NullByte or NUL Charactervulnerability in theEventLogAppender of Apachelog4net. A NUL character inlogged content ended theWindows Event Log record at…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-778 (CWE-778)1 other warning in 30 days →Same productEarlier Apache log4net warnings2 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Apache log4net: Yellow, plan it in. Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net. A NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently not stored. A party w…

The flaws

  • CVE-2026-105243: Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were… (CVSS 5.3 · EPSS 1%)
  • CVE-2026-105239: Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of… (CVSS 5.3 · EPSS 1%)
  • CVE-2026-105241: Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache… (CVSS 5.3 · EPSS 1%)
  • CVE-2026-105242: Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter… (CVSS 5.3 · EPSS 1%)

The fix

Upgrade Apache log4net: 3.5.0 or later on your release line

Who is exposed: Apache log4net before 3.5.0

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 5.3 medium

References

Original description

Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough. Only applications on Windows that use EventLogAppender are affected. This issue affects Apache log4net: from 1.2.9 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.

Last activity 6 Oct 2026. Patch Forecast updates every hour.