CVE-2026-105241

Name of the Vulnerable Software and Affected Versions Apache log4net versions 1.2.9 through 3.4.x

Description Improper handling of Unicode encoding in the SmtpPickupDirAppender occurs when the mail file writer encounters content it cannot encode, such as an unpaired UTF-16 surrogate. This causes the write operation to fail, resulting in the discard of every buffered event in the batch and potentially leaving a truncated mail file in the pickup directory. An attacker capable of influencing log message content could use this behavior to suppress records of other events. Only applications utilizing the SmtpPickupDirAppender are affected.

Recommendations Upgrade to version 3.5.0.