Source: log4net Version: 1.2.10+dfsg-10 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerabilities were published for log4net. CVE-2026-105239[0]: | Improper Neutralization of Null Byte or NUL Character vulnerability | in the EventLogAppender of Apache log4net. A NUL character in | logged content ended the Windows Event Log record at that point, so | everything the layout rendered after it, including exception text | and trailing fields, was silently not stored. A party whose data | reaches a log message could hide the rest of that record. Only | applications on Windows that use EventLogAppender are affected. | This issue affects Apache log4net: from 1.2.9 before 3.5.0. Users | are recommended to upgrade to version 3.5.0, which fixes the issue. CVE-2026-105240[1]: | Improper Neutralization of Null Byte or NUL Character vulnerability | in the OutputDebugStringAppender of Apache log4net. A NUL character | in logged content ended the debug output record at that point, so | everything the layout rendered after it, including exception text | and trailing fields, was silently lost. A party whose data reaches a | log message could hide the rest of that record. Only applications on | Windows that use OutputDebugStringAppender are affected. This issue | affects Apache log4net: from 1.2.9 before 3.5.0. Users are | recommended to upgrade to version 3.5.0, which fixes the issue. CVE-2026-105241[2]: | Improper Handling of Unicode Encoding vulnerability in the | SmtpPickupDirAppender of Apache log4net. Content that the mail file | writer cannot encode, such as an unpaired UTF-16 surrogate, made the | write throw. Every buffered event in the batch was discarded, not | only the one carrying the content, and a truncated mail could be | left in the pickup directory. A party whose data reaches a log | message could suppress the records of other events. Only | applications that use SmtpPickupDirAppender are affected. This | issue affects Apache log4net: from 1.2.9 before 3.5.0. Users are | recommended to upgrade to version 3.5.0, which fixes the issue. CVE-2026-105243[3]: | Insufficient Logging vulnerability in the EventLogAppender of Apache | log4net. Long messages were truncated to a fixed size that exceeds | what the Windows Event Log accepts once the log and source names are | counted, and the event log then stored nothing and reported nothing. | A party whose data reaches a log message could suppress the whole | record by making it long enough. Only applications on Windows that | use EventLogAppender are affected. This issue affects Apache | log4net: from 1.2.9 before 3.5.0. Users are recommended to upgrade | to version 3.5.0, which fixes the issue. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-105239 https://www.cve.org/CVERecord?id=CVE-2026-105239 [1] https://security-tracker.debian.org/tracker/CVE-2026-105240 https://www.cve.org/CVERecord?id=CVE-2026-105240 [2] https://security-tracker.debian.org/tracker/CVE-2026-105241 https://www.cve.org/CVERecord?id=CVE-2026-105241 [3] https://security-tracker.debian.org/tracker/CVE-2026-105243 https://www.cve.org/CVERecord?id=CVE-2026-105243 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
