CVE-2026-105243: Apache log4net: Oversize EventLogAppender record silently discarded
Apache log4net's EventLogAppender can silently discard oversized Windows Event Log records (CVE-2026-105243).
Apache disclosed CVE-2026-105243, a moderate insufficient-logging flaw in log4net's EventLogAppender. Long messages are truncated to a fixed size that the Windows Event Log will not accept, so records can be silently discarded. CVSS 3.1 is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Affected versions are log4net 1.2.9 before 3.5.0 and a listed development range before commit 28fbfb25678c.
- Moderate CVSS 5.3 with low integrity impact only.
- Oversized EventLogAppender messages can be silently discarded.
- Affects log4net 1.2.9 before 3.5.0.
- No exploitation is reported.
- CVEs
- CVE-2026-105243
- Vendors
- Apache
- Products
- Apache log4net
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105243 | Silent Event Log drop in Apache log4net EventLogAppender | 5.3 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 02e1e115435888485f2e28b414d267e39e799e07 | sions: - Apache log4net 1.2.9 before 3.5.0 - Apache log4net 02e1e115435888485f2e28b414d267e39e799e07 before 28fbfb25678c48a8cc5bc9b94ead0dddfc39ffed Description |
| sha1 | 28fbfb25678c48a8cc5bc9b94ead0dddfc39ffed | che log4net 02e1e115435888485f2e28b414d267e39e799e07 before 28fbfb25678c48a8cc5bc9b94ead0dddfc39ffed Description: Insufficient Logging vulnerability in the Even |
From the original article
Posted by Jan Friedrich on Oct 06 Severity: moderate CVSS 3. 1: 5. 3 (medium) CVSS:3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.