CVE-2026-105242

Name of the Vulnerable Software and Affected Versions Apache log4net versions 1.2.11 through 3.4.x

Description Improper handling of exceptional conditions in the aspnet-request pattern converter allows a sender to suppress the log record of their own request. When reading request parameters, ASP.NET request validation is triggered; if the request contains content such as markup, the layout throws an exception and the appender discards the entire event. This issue specifically affects applications running on ASP.NET for .NET Framework that utilize the %aspnet-request layout.

Recommendations Upgrade to version 3.5.0.