CVE-2026-105241: Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch
Apache log4net CVE-2026-105241 lets unencodable Unicode discard an entire SmtpPickupDirAppender email batch.
Apache disclosed CVE-2026-105241, an improper Unicode-encoding handling flaw in log4net's SmtpPickupDirAppender. Content the mail writer cannot encode, such as an unpaired UTF-16 sequence, causes the whole pickup-directory batch to be discarded. CVSS 3.1 is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Affected releases are log4net 1.2.9 before 3.5.0 and commits before 4d2e10f0908199604b4326f9df6d0b43b871e333.
- CVE-2026-105241 is a moderate Unicode-encoding flaw in SmtpPickupDirAppender.
- Unencodable content, such as unpaired UTF-16, drops an entire mail batch.
- CVSS 3.1 is 5.3 (network, no privileges, low integrity only).
- Affects log4net 1.2.9 before 3.5.0 and an unfixed development range.
- CVEs
- CVE-2026-105241
- Vendors
- Apache Software Foundation
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105241 | Unicode encoding flaw drops log4net SMTP pickup batches | 5.3 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 02e1e115435888485f2e28b414d267e39e799e07 | sions: - Apache log4net 1.2.9 before 3.5.0 - Apache log4net 02e1e115435888485f2e28b414d267e39e799e07 before 4d2e10f0908199604b4326f9df6d0b43b871e333 Description |
| sha1 | 4d2e10f0908199604b4326f9df6d0b43b871e333 | che log4net 02e1e115435888485f2e28b414d267e39e799e07 before 4d2e10f0908199604b4326f9df6d0b43b871e333 Description: Improper Handling of Unicode Encoding vulnerab |
From the original article
Posted by Jan Friedrich on Oct 06 Severity: moderate CVSS 3. 1: 5. 3 (medium) CVSS:3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.