CVE-2026-105243

Apache log4net’s Windows EventLogAppender has an insufficient-logging flaw in versions from 1.2.9 before 3.5.0. Long log messages are truncated to a fixed size that, once the log and source names are included, still exceeds what the Windows Event Log will accept, so the event is neither stored nor reported. Anyone who can cause their data to be written into a log message can suppress the entire record by making that message long enough, weakening integrity of the audit trail without reading secrets or crashing the app. Only applications running on Windows and configured to use EventLogAppender are affected. There is no known public proof of concept and no evidence of exploitation in the wild; the fix is version 3.5.0.

What to do: Upgrade Apache log4net to 3.5.0 on every Windows application that uses EventLogAppender. Until then, treat Windows Event Log as incomplete for those apps: review whether attacker-controlled or untrusted data is written into log messages, and cross-check other appenders or central logging for gaps. After upgrading, confirm long messages are recorded rather than silently dropped.