CVE-2026-105242: Apache log4net: Request validation failure drops the event in the aspnet-request converter
Apache log4net's aspnet-request converter can drop events when ASP.NET request validation fails (CVE-2026-105242).
Apache disclosed CVE-2026-105242, a moderate improper-exception-handling flaw in log4net's aspnet-request pattern converter. Reading request parameters can trigger an ASP.NET request validation failure that drops the log event. CVSS 3.1 is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Affected versions are log4net 1.2.11 before 3.5.0 and a listed development range before commit 145203420c57.
- Moderate CVSS 5.3 with low integrity impact only.
- aspnet-request converter can drop events after request validation fails.
- Affects log4net 1.2.11 before 3.5.0.
- No exploitation is reported.
- CVEs
- CVE-2026-105242
- Vendors
- Apache
- Products
- Apache log4net
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105242 | Log suppression via aspnet-request in Apache log4net | 5.3 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 145203420c579a703008b4b723b6a080757f4964 | che log4net 243f1e9f3ee235955bade4b4fe664a903378719a before 145203420c579a703008b4b723b6a080757f4964 Description: Improper Handling of Exceptional Conditions vu |
| sha1 | 243f1e9f3ee235955bade4b4fe664a903378719a | ions: - Apache log4net 1.2.11 before 3.5.0 - Apache log4net 243f1e9f3ee235955bade4b4fe664a903378719a before 145203420c579a703008b4b723b6a080757f4964 Description |
From the original article
Posted by Jan Friedrich on Oct 06 Severity: moderate CVSS 3. 1: 5. 3 (medium) CVSS:3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.