Six moderate Apache log4net flaws fixed in 3.5.0

Apache log4net before 3.5.0 has six CVSS 5.3 flaws that can truncate or discard log records.

On 7 October 2026, oss-security posts described six moderate Apache log4net flaws, each scored CVSS 3.1 5.3 with low integrity impact and no confidentiality or availability impact. CVE-2026-105239 and CVE-2026-105240 let a NUL byte truncate EventLogAppender Windows Event Log records and OutputDebugStringAppender debug output. CVE-2026-105243 can silently discard oversized EventLogAppender records, and CVE-2026-105241 drops an entire SmtpPickupDirAppender batch when content cannot be encoded, such as an unpaired UTF-16 sequence. CVE-2026-105242 can drop a log event when the aspnet-request converter hits an ASP.NET request-validation failure, and CVE-2026-105244 makes RemoteSyslogAppender remove characters outside visible ASCII and space. Fixes are in log4net 3.5.0, with affected ranges starting at 1.2.9, 1.2.11, or 1.2.12 depending on the CVE, and named fix commits for several issues. Some posts credit Apache and others credit Jan Friedrich; none of the advisories report in-the-wild exploitation.