CVE-2026-105243

MediumCVSS 5.3/10Last modified Oct 9, 2026

Description

Insufficient Logging vulnerability in the EventLogAppender of Apache log4net.

Long messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough. Only applications on Windows that use EventLogAppender are affected.

This issue affects Apache log4net: from 1.2.9 before 3.5.0.

Users are recommended to upgrade to version 3.5.0, which fixes the issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-778

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache log4net	>= 1.2.9, < 3.5.0
Apache Software Foundation	Apache log4net	>= 02e1e115435888485f2e28b414d267e39e799e07, < 28fbfb25678c48a8cc5bc9b94ead0dddfc39ffed

References

https://github.com/apache/logging-log4net/commit/28fbfb25678c48a8cc5bc9b94ead0dddfc39ffedPatch
https://github.com/apache/logging-log4net/pull/315Patch
https://lists.apache.org/thread.html/jr6fj5skv1vnjbc9jmt8bp151p8ow1rpMailing List, Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/10/07/17Mailing List, Third Party Advisory

Timeline

Published: Oct 6, 2026
Last modified: Oct 9, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1052445.3Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net. Every character outside visible ASCII CVE-2026-1052453.7A vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function server_info of the file python/sglang/srt CVE-2026-1052467.3A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/a CVE-2026-1052477.3A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the f CVE-2026-1052486.3A security flaw has been discovered in vgmstream up to r2117. This affects the function parse_params/txtp_parse of the file src/meta/txtp_pa CVE-2026-1052494.8A weakness has been identified in vgmstream up to r2117. This impacts the function make_group_random of the file src/meta/txtp_process.c of CVE-2026-105256.1The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and outputting it back CVE-2026-1052504.3A security vulnerability has been detected in vgmstream up to r2117. Affected is the function decode_ms_ima of the file src/coding/ima_decod CVE-2026-1052516.3A vulnerability was detected in vgmstream up to r2117. Affected by this vulnerability is the function ps_find_padding of the file src/coding CVE-2026-1052537.3A vulnerability was determined in itsourcecode Online Admission System Project 1.0. This issue affects some unknown processing of the file /CVE-2026-1052546.3A vulnerability was identified in itsourcecode Online Admission System 1.0. Impacted is an unknown function of the file /admin/schoolyear.ph CVE-2026-1052565.3The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking ag