CVE-2026-105241

Analyzed Analyzed - Analysis Complete

Unicode Handling Flaw in Apache log4net SmtpPickupDirAppender

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: Apache Software Foundation

Description

Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail could be left in the pickup directory. A party whose data reaches a log message could suppress the records of other events. Only applications that use SmtpPickupDirAppender are affected. This issue affects Apache log4net: from 1.2.9 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105241

EUVD

EUVD-2026-93866

Affected Vendors & Products

Vendor	Product	Version / Range
apache	log4net	From 1.2.9 (inc) to 3.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-176	The product does not properly handle when an input contains Unicode encoding.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper handling of Unicode encoding in Apache log4net's SmtpPickupDirAppender. When the mail file writer encounters unencodable content like an unpaired UTF-16 surrogate, it discards the entire batch of buffered log events instead of just the problematic one. This can leave a truncated mail file in the pickup directory and allow an attacker to suppress records of other events by manipulating data that reaches a log message.

Detection Guidance

To detect this vulnerability, check if your system uses Apache log4net versions between 1.2.9 and 3.5.0. Inspect log files for truncated mail entries in the SmtpPickupDirAppender directory. Verify if any mail files in the pickup directory are incomplete or corrupted.

Impact Analysis

If you use applications that rely on Apache log4net's SmtpPickupDirAppender, this vulnerability could allow an attacker to hide log entries by causing errors in log processing. This might result in missing critical audit trails or security events, potentially obscuring malicious activity. Only versions 1.2.9 to 3.4.0 are affected.

Compliance Impact

This vulnerability could impact compliance by potentially causing incomplete audit logs or missing security events. Regulations like GDPR and HIPAA require accurate and complete logging for accountability and breach detection. If log entries are suppressed, organizations may fail to meet these requirements, leading to compliance violations.

Mitigation Strategies

Upgrade Apache log4net to version 3.5.0 or later immediately. If upgrading is not possible, disable the SmtpPickupDirAppender feature to prevent the issue. Review and remove any truncated mail files left in the pickup directory.

Hi! I’m here to help you understand CVE-2026-105241. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70