CVE-2026-105241

MEDIUM 5.3

Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail could be left in the pickup directory. A party whose data reaches a log message could suppress the records of other events. Only applications that use SmtpPickupDirAppender are affected. This issue affects Apache log4net: from 1.2.9 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.

CWE	CWE-176
Vendor	apache software foundation
Product	apache log4net
Published	Oct 6, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache log4net

Be the first to know when new medium vulnerabilities affecting apache software foundation apache log4net are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

Apache Software Foundation / Apache log4net

1.2.9 < 3.5.0

Apache Software Foundation / Apache log4net

02e1e115435888485f2e28b414d267e39e799e07 < 4d2e10f0908199604b4326f9df6d0b43b871e333

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/apache/logging-log4net/pull/315 github.com: https://github.com/apache/logging-log4net/commit/4d2e10f0908199604b4326f9df6d0b43b871e333 lists.apache.org: https://lists.apache.org/thread.html/hg8dgh3oy8bp3dhb8nsygk9kw2o401ws

Credits

The Apache Software Foundation Claude Security Jan Friedrich