CVE-2026-105243: Apache log4net: Oversize EventLogAppender record silently discarded
Insufficient Logging vulnerability in the EventLogAppender of Apache log4net.
Long messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough. Only applications on Windows that use EventLogAppender are affected.
This issue affects Apache log4net: from 1.2.9 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache log4netto a version that resolves this vulnerability.Fixed in 3.5.0
Event History
Frequently Asked Questions
Which deployments are affected?
Only Windows applications that use Apache log4net's EventLogAppender are affected. Apache log4net versions from 1.2.9 before 3.5.0 are in scope.
What must an attacker be able to do to exploit this issue?
An attacker needs to cause sufficiently long data to be included in an application log message. When the resulting EventLogAppender record exceeds the Windows Event Log limit after log and source names are counted, the entire record can be discarded without reporting an error.
What is the impact of successful exploitation?
The affected log record is not stored, allowing suppression of that event from the Windows Event Log. The provided severity vector indicates integrity impact only, with no confidentiality or availability impact.
What should teams do to remediate the issue?
Upgrade Apache log4net to version 3.5.0, which fixes the issue. If an immediate upgrade is not possible, prioritize preventing unbounded externally influenced data from being written into EventLogAppender messages.