Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-105242

Apache log4net: Request validation failure drops the event in the aspnet-request converter

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
apache

Description

Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request. Only applications on ASP.NET for .NET Framework whose layout uses %aspnet-request are affected. This issue affects Apache log4net: from 1.2.11 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Apache Software Foundation Apache log4net

Default version status: unaffected

  • 1.2.11 to < 3.5.0affected
pkg:nuget/log4net

Apache Software Foundation Apache log4net

Default version status: unaffected

  • 243f1e9f3ee235955bade4b4fe664a903378719a to < 145203420c579a703008b4b723b6a080757f4964affected
pkg:nuget/log4net

References