CVE-2026-105242 in log4net
Summary
by MITRE • 10/06/2026
Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net.
Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request. Only applications on ASP.NET for .NET Framework whose layout uses %aspnet-request are affected.
This issue affects Apache log4net: from 1.2.11 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in Apache Log4Net pertains to an improper handling of exceptional conditions within the aspnet-request pattern converter, specifically affecting versions from 1.2.11 up to but not including 3.5.0 on the .NET Framework platform. This flaw arises during the process where log events are formatted for output using layouts that incorporate the %aspnet-request conversion specifier. The core technical issue stems from how Log4Net interacts with ASP.NET request validation mechanisms when processing incoming HTTP requests. When a layout attempts to extract data such as query string parameters or form fields, it inadvertently triggers ASP.NET's built-in request validation feature. This security mechanism is designed to detect potentially dangerous content, such as HTML markup or script tags, within user input and typically throws an HttpRequestValidationException if such content is detected.
In the context of Log4Net prior to version 3.5.0, this exception was not adequately handled by the aspnet-request converter logic. Instead of gracefully managing the validation error, the unhandled exception caused the entire logging event processing pipeline for that specific request to fail catastrophically. Consequently, the appender responsible for writing the log record discarded the whole event rather than attempting to sanitize the input or fallback to a safe representation of the data. This behavior creates a significant reliability gap in application observability and security monitoring capabilities. The vulnerability is strictly limited to applications running on ASP.NET for .NET Framework that utilize layouts containing the %aspnet-request pattern, as other platforms like .NET Core do not employ this specific request validation model in the same manner.
The operational impact of this flaw allows a malicious sender or attacker to suppress log records associated with their own requests. By crafting HTTP requests that contain content triggering ASP.NET's request validation, such as embedded HTML tags or script elements, an adversary can cause the logging subsystem to fail silently for those specific events. This results in a denial-of-service condition relative to audit trails and security monitoring systems. Attackers leveraging this vulnerability could effectively erase evidence of their activities from application logs, thereby hindering incident response efforts, forensic analysis, and compliance auditing processes that rely on comprehensive log data. The inability to capture these records undermines the integrity of security information and event management (SIEM) solutions integrated with Log4Net outputs.
From a classification perspective, this vulnerability aligns with CWE-755: Improper Handling of Exceptional Conditions, as the software fails to properly handle an unexpected or exceptional condition that arises during normal operation. It also relates to CWE-209: Generation of Error Message Containing Sensitive Information if the exception handling logic inadvertently exposed stack traces in error responses, although the primary issue here is data loss rather than information leakage. In terms of adversary tactics, this behavior supports ATT&CK technique T1562.001: Impair Defenses: Disable or Modify Tools, specifically by interfering with logging mechanisms to avoid detection. The suppression of log events effectively blinds security teams to malicious actions performed via the affected application endpoints.
To mitigate this vulnerability and restore full observability capabilities, organizations must upgrade Apache Log4Net to version 3.5.0 or later. This release includes fixes that properly handle exceptions thrown by ASP.NET request validation within the aspnet-request converter logic. The updated implementation ensures that even if a request contains content triggering validation errors, the logging process continues without discarding the entire event. Developers should verify their application configurations to ensure they are using compatible layout patterns and confirm that all instances of Log4Net in production environments have been patched. Regular patch management cycles and dependency scanning tools can help identify remaining unpatched installations of vulnerable versions across an organization's infrastructure, ensuring consistent logging integrity and maintaining the effectiveness of security monitoring controls.