CVE-2026-105241

MediumCVSS 5.3/10Last modified Oct 9, 2026

Description

Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net.

Content that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail could be left in the pickup directory. A party whose data reaches a log message could suppress the records of other events. Only applications that use SmtpPickupDirAppender are affected.

This issue affects Apache log4net: from 1.2.9 before 3.5.0.

Users are recommended to upgrade to version 3.5.0, which fixes the issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-176

Affected software

No affected versions have been published.

Timeline

Published: Oct 6, 2026
Last modified: Oct 9, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1052425.3Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parame CVE-2026-1052435.3Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were truncated to a fixed size that exceeds wha CVE-2026-1052445.3Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII CVE-2026-1052453.7A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function server_info of the file python/sglang/srt CVE-2026-1052467.3A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/a CVE-2026-1052477.3A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the f CVE-2026-1052486.3A security flaw has been discovered in vgmstream up to r2117. This affects the function parse_params/txtp_parse of the file src/meta/txtp_pa CVE-2026-1052494.8A weakness has been identified in vgmstream up to r2117. This impacts the function make_group_random of the file src/meta/txtp_process.c of CVE-2026-105256.1The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and outputting it back CVE-2026-1052504.3A security vulnerability has been detected in vgmstream up to r2117. Affected is the function decode_ms_ima of the file src/coding/ima_decod CVE-2026-1052516.3A vulnerability was detected in vgmstream up to r2117. Affected by this vulnerability is the function ps_find_padding of the file src/coding CVE-2026-1052537.3A vulnerability was determined in itsourcecode Online Admission System Project 1.0. This issue affects some unknown processing of the file /