CVE-2026-105241

Katalog CVE

CVSS 5.3 · Medium EPSS 0,82%

Kerentanan Improper Handling of Unicode Encoding pada apache log4net. Skor CVSS 3.1 5.3 (Medium) menurut apache.org.

Deskripsi (NVD)

Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail could be left in the pickup directory. A party whose data reaches a log message could suppress the records of other events. Only applications that use SmtpPickupDirAppender are affected. This issue affects Apache log4net: from 1.2.9 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.

Rincian

Terbit di NVD

6 Oktober 2026

Terakhir diubah

9 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber apache.org
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-176: Improper Handling of Unicode Encoding

EPSS (30 hari)

0,82% peluang dieksploitasi; lebih tinggi dari 56,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread.html/hg8dgh3oy8bp3dhb8nsygk9kw2o401ws mailing list · advisory vendor
• https://github.com/apache/logging-log4net/commit/4d2e10f0908199604b4326f9df6d0b43b871e333 patch
• https://github.com/apache/logging-log4net/pull/315 patch
• http://www.openwall.com/lists/oss-security/2026/10/07/15 mailing list · advisory pihak ketiga