CVE catalog

CVE-2026-105241

DEBIAN-CVE-2026-105241

Severity: Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Published: Oct 6, 2026, 7:49:03 PM UTC
Updated: Oct 10, 2026, 9:47:47 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.82% · Oct 25, 2026

Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. Content that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail could be left in the pickup directory. A party whose data reaches a log message could suppress the records of other events. Only applications that use SmtpPickupDirAppender are affected. This issue affects Apache log4net: from 1.2.9 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	log4net	13	`1.2.10+dfsg-10`	vulnerable
Debian	log4net	13	`1.2.10+dfsg-9`	vulnerable
Debian	log4net	14	`1.2.10+dfsg-10`	vulnerable
Debian	log4net	14	`1.2.10+dfsg-9`	vulnerable
Fedora	log4net	44	`0:3.5.0-1.fc44`	fixed
Fedora	nant	44	`1:0.92-43.fc44`	fixed
Fedora	log4net	43	`0:3.5.0-1.fc43`	fixed
Fedora	nant	43	`1:0.92-43.fc43`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Fedora	log4net	rpm	44	`0:3.5.0-1.fc44`	Not reported	FEDORA-2026-0BF84C3130#CVE-2026-105241	Not reported
Fedora	nant	rpm	44	`1:0.92-43.fc44`	Not reported	FEDORA-2026-0BF84C3130#CVE-2026-105241	Not reported
Fedora	log4net	rpm	43	`0:3.5.0-1.fc43`	Not reported	FEDORA-2026-588BC7E01C#CVE-2026-105241	Not reported
Fedora	nant	rpm	43	`1:0.92-43.fc43`	Not reported	FEDORA-2026-588BC7E01C#CVE-2026-105241	Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

[liblog4net1.2-cil]Affected
Source package: [log4net]
Details (2)
- 1.2.10+dfsg-9 · all · trixie
  Affected
  pypi · log4net · debian · 13
- 1.2.10+dfsg-9 · all · trixie
  Affected
  pypi · log4net · debian · 13
[liblog4net-cil-dev]Affected
Source package: [log4net]
Details (2)
- 1.2.10+dfsg-9 · all · trixie
  Affected
  pypi · log4net · debian · 13
- 1.2.10+dfsg-9 · all · trixie
  Affected
  pypi · log4net · debian · 13

[Fedora 43]

[log4net]Unknown
Source package: [log4net]
Details (2)
- 2.0.8-23.fc43 · aarch64 · 43
  Unknown
  Version impact unknown
  pypi · log4net · fedora · 43
- 2.0.8-23.fc43 · x86_64 · 43
  Unknown
  Version impact unknown
  pypi · log4net · fedora · 43
[log4net-devel]Unknown
Source package: [log4net]
Details (3)
- 2.0.8-23.fc43 · aarch64 · 43
  Unknown
  Version impact unknown
  pypi · log4net · fedora · 43
- 2.0.8-23.fc43 · i686 · 43
  Unknown
  Version impact unknown
  pypi · log4net · fedora · 43
- 2.0.8-23.fc43 · x86_64 · 43
  Unknown
  Version impact unknown
  pypi · log4net · fedora · 43
[nant]Unknown
Source package: [nant]
Details (2)
- 1:0.92-40.fc43 · aarch64 · 43
  Unknown
  Version impact unknown
  pypi · nant · fedora · 43
- 1:0.92-40.fc43 · x86_64 · 43
  Unknown
  Version impact unknown
  pypi · nant · fedora · 43
[nant-devel]Unknown
Source package: [nant]
Details (3)
- 1:0.92-40.fc43 · aarch64 · 43
  Unknown
  Version impact unknown
  pypi · nant · fedora · 43
- 1:0.92-40.fc43 · i686 · 43
  Unknown
  Version impact unknown
  pypi · nant · fedora · 43
- 1:0.92-40.fc43 · x86_64 · 43
  Unknown
  Version impact unknown
  pypi · nant · fedora · 43
[nant-docs]Unknown
Source package: [nant]
Details (2)
- 1:0.92-40.fc43 · aarch64 · 43
  Unknown
  Version impact unknown
  pypi · nant · fedora · 43
- 1:0.92-40.fc43 · x86_64 · 43
  Unknown
  Version impact unknown
  pypi · nant · fedora · 43

[Fedora 44]

[log4net]Unknown
Source package: [log4net]
Details (2)
- 2.0.8-24.fc44 · aarch64 · 44
  Unknown
  Version impact unknown
  pypi · log4net · fedora · 44
- 2.0.8-24.fc44 · x86_64 · 44
  Unknown
  Version impact unknown
  pypi · log4net · fedora · 44
[log4net-devel]Unknown
Source package: [log4net]
Details (3)
- 2.0.8-24.fc44 · aarch64 · 44
  Unknown
  Version impact unknown
  pypi · log4net · fedora · 44
- 2.0.8-24.fc44 · i686 · 44
  Unknown
  Version impact unknown
  pypi · log4net · fedora · 44
- 2.0.8-24.fc44 · x86_64 · 44
  Unknown
  Version impact unknown
  pypi · log4net · fedora · 44
[nant]Unknown
Source package: [nant]
Details (2)
- 1:0.92-41.fc44 · aarch64 · 44
  Unknown
  Version impact unknown
  pypi · nant · fedora · 44
- 1:0.92-41.fc44 · x86_64 · 44
  Unknown
  Version impact unknown
  pypi · nant · fedora · 44
[nant-devel]Unknown
Source package: [nant]
Details (3)
- 1:0.92-41.fc44 · aarch64 · 44
  Unknown
  Version impact unknown
  pypi · nant · fedora · 44
- 1:0.92-41.fc44 · i686 · 44
  Unknown
  Version impact unknown
  pypi · nant · fedora · 44
- 1:0.92-41.fc44 · x86_64 · 44
  Unknown
  Version impact unknown
  pypi · nant · fedora · 44
[nant-docs]Unknown
Source package: [nant]
Details (2)
- 1:0.92-41.fc44 · aarch64 · 44
  Unknown
  Version impact unknown
  pypi · nant · fedora · 44
- 1:0.92-41.fc44 · x86_64 · 44
  Unknown
  Version impact unknown
  pypi · nant · fedora · 44

Observed: Oct 23, 2026, 8:14:21 PM UTC

References

[FIRST EPSS] · [Fedora security updates (Bodhi)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]