Vulnerability · Published Oct 6, 2026 · Assigned by apache
CVE-2026-105242Apache log4net: Request validation failure drops the event in the aspnet-request converter
Medium 5.3
In plain English
A medium-severity security flaw in Apache log4net from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities).
Official description
Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request. Only applications on ASP.NET for .NET Framework whose layout uses %aspnet-request are affected. This issue affects Apache log4net: from 1.2.11 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | log4net | no fix listed | DEBIAN-CVE-2026-105242 |
| Debian:14 | log4net | no fix listed | DEBIAN-CVE-2026-105242 |
| Ubuntu:22.04:LTS | log4net | no fix listed | UBUNTU-CVE-2026-105242 |
| Ubuntu:24.04:LTS | log4net | no fix listed | UBUNTU-CVE-2026-105242 |
| Ubuntu:26.04:LTS | log4net | no fix listed | UBUNTU-CVE-2026-105242 |
| Ubuntu:26.10 | log4net | no fix listed | UBUNTU-CVE-2026-105242 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache log4net | 1.2.11 – before 3.5.0 |
| Apache Software Foundation | Apache log4net | 243f1e9f3ee235955bade4b4fe664a903378719a – before 145203420c579a703008b4b723b6a080757f4964 |
Weakness: CWE-755 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N