CVE-2026-105243

EUVD-2026-93869

06.10.2026, 20:17

Insufficient Logging vulnerability in the EventLogAppender of Apache log4net.

Long messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough. Only applications on Windows that use EventLogAppender are affected.

This issue affects Apache log4net: from 1.2.9 before 3.5.0.

Users are recommended to upgrade to version 3.5.0, which fixes the issue.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
apache	CNA	5.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources.

Vendor	Product	Version	Source
apache	log4net	1.2.9 ≤ 𝑥 < 3.5.0	CNA

Common Weakness Enumeration

CWE-778 - Insufficient Logging
When a security-critical event occurs, the software either does not record the event or omits important details about the event when logging it.

References

https://github.com/apache/logging-log4net/commit/28fbfb25678c48a8cc5bc9b94ead0dddfc39ffed

https://github.com/apache/logging-log4net/pull/315

https://lists.apache.org/thread.html/jr6fj5skv1vnjbc9jmt8bp151p8ow1rp