Vulnerability · Published Oct 6, 2026 · Assigned by apache
CVE-2026-105243Apache log4net: Oversize EventLogAppender record silently discarded
Medium 5.3
In plain English
A medium-severity security flaw in Apache log4net from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 57% of all known vulnerabilities).
Official description
Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough. Only applications on Windows that use EventLogAppender are affected. This issue affects Apache log4net: from 1.2.9 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | log4net | no fix listed | DEBIAN-CVE-2026-105243 |
| Debian:14 | log4net | no fix listed | DEBIAN-CVE-2026-105243 |
| Ubuntu:22.04:LTS | log4net | no fix listed | UBUNTU-CVE-2026-105243 |
| Ubuntu:24.04:LTS | log4net | no fix listed | UBUNTU-CVE-2026-105243 |
| Ubuntu:26.04:LTS | log4net | no fix listed | UBUNTU-CVE-2026-105243 |
| Ubuntu:26.10 | log4net | no fix listed | UBUNTU-CVE-2026-105243 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache log4net | 1.2.9 – before 3.5.0 |
| Apache Software Foundation | Apache log4net | 02e1e115435888485f2e28b414d267e39e799e07 – before 28fbfb25678c48a8cc5bc9b94ead0dddfc39ffed |
Weakness: CWE-778 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N