CVE-2026-105242

Analyzed Analyzed - Analysis Complete

Improper Exception Handling in Apache log4net ASP.NET Request Pattern

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: Apache Software Foundation

Description

Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request. Only applications on ASP.NET for .NET Framework whose layout uses %aspnet-request are affected. This issue affects Apache log4net: from 1.2.11 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105242

EUVD

EUVD-2026-93867

Affected Vendors & Products

Vendor	Product	Version / Range
apache	log4net	From 1.2.11 (inc) to 3.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-755	The product does not handle or incorrectly handles an exceptional condition.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper handling of exceptional conditions in Apache log4net's aspnet-request pattern converter. When request parameters are read, ASP.NET request validation triggers, causing the layout to throw an exception. This leads to the appender discarding the entire log event, allowing a sender to suppress their own request from being logged.

Detection Guidance

This vulnerability affects applications using Apache log4net versions before 3.5.0 with ASP.NET layouts containing %aspnet-request. Detection involves checking log4net versions and ASP.NET application configurations. No specific commands are provided in the context.

Impact Analysis

The impact includes potential loss of critical log data, as attackers could suppress their own malicious requests from being recorded. This affects debugging, auditing, and security monitoring. Only ASP.NET applications using .NET Framework with layouts containing %aspnet-request are affected.

Compliance Impact

This vulnerability allows attackers to suppress log records of their own requests, which could lead to incomplete or missing audit trails. For compliance with standards like GDPR or HIPAA, which require accurate logging and monitoring, this could result in non-compliance due to the inability to track or investigate security events properly.

Mitigation Strategies

Upgrade Apache log4net to version 3.5.0 or later to fix the improper handling of exceptional conditions in the aspnet-request pattern converter.

Hi! I’m here to help you understand CVE-2026-105242. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70