CVE-2026-105242: Apache log4net: Request validation failure drops the event in the aspnet-request converter
Apache log4net's aspnet-request converter can drop events when ASP.NET request validation fails (CVE-2026-105242).
30
Vulnerability3 · 1 read
CVE-2026-105242
Log suppression via aspnet-request in Apache log4net
- CVSS 3.1
- 5.3 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache log4net mishandles exceptional conditions in its aspnet-request pattern converter (CWE-755). When a layout uses %aspnet-request, reading request parameters runs ASP.NET request validation, so a request that includes content such as markup can make the layout throw and cause the appender to discard the whole event. An unauthenticated remote sender can thereby suppress the log record of their own request, reducing audit integrity without affecting confidentiality or availability (CVSS 3.1 base score 5.3). Only applications on ASP.NET for .NET Framework that use %aspnet-request and run log4net from 1.2.11 before 3.5.0 are affected. No public proof of concept is known, and the issue is not in CISA KEV.
What to do: Upgrade Apache log4net to 3.5.0. Until that is done, stop using the %aspnet-request converter in layouts on ASP.NET Framework applications, and review logging config and recent access logs for requests that should have been recorded but were dropped.
| Product | Affected |
|---|---|
| Apache log4net | 1.2.11 before 3.5.0 |
Estimated exposure
largeon the order of 100,000+ ASP.NET Framework apps (subset of log4net deployments; exact %aspnet-request usage unknown) — log4net is a long-standing, widely deployed .NET logging library, but only ASP.NET on .NET Framework applications whose layouts include %aspnet-request are vulnerable, so this is an order-of-magnitude estimate of that configuration subset…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request. Only applications on ASP.NET for .NET Framework whose layout uses %aspnet-request are affected. This issue affects Apache log4net: from 1.2.11 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.