CVSS 3.1
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Атакува се
Време до експлоатация
Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.
- Експлоатация: няма данни за експлоатация
- Атаката може да се автоматизира
Описание
Оригинално описание
Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail could be left in the pickup directory. A party whose data reaches a log message could suppress the records of other events. Only applications that use SmtpPickupDirAppender are affected. This issue affects Apache log4net: from 1.2.9 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Засегнати продукти
- Apache Software Foundation Apache log4net: 1.2.9 преди 3.5.0
- Apache Software Foundation Apache log4net: 02e1e115435888485f2e28b414d267e39e799e07 преди 4d2e10f0908199604b4326f9df6d0b43b871e333
Вид слабост
История
- 6 октомври 2026 Публикувано
Други уязвимости в Apache Software Foundation Apache log4net
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-105241
- https://nvd.nist.gov/vuln/detail/CVE-2026-105241
- https://github.com/apache/logging-log4net/pull/315
- https://github.com/apache/logging-log4net/commit/4d2e10f0908199604b4326f9df6d0b43b871e333
- https://lists.apache.org/thread.html/hg8dgh3oy8bp3dhb8nsygk9kw2o401ws
- http://www.openwall.com/lists/oss-security/2026/10/07/15