CVE catalog
CVE-2026-105242
DEBIAN-CVE-2026-105242
- Severity
- Medium · CVSS 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 0.82% · Oct 25, 2026
Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net. Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request. Only applications on ASP.NET for .NET Framework whose layout uses %aspnet-request are affected. This issue affects Apache log4net: from 1.2.11 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | log4net | 13 | 1.2.10+dfsg-10 | vulnerable |
| Debian | log4net | 13 | 1.2.10+dfsg-9 | vulnerable |
| Debian | log4net | 14 | 1.2.10+dfsg-10 | vulnerable |
| Debian | log4net | 14 | 1.2.10+dfsg-9 | vulnerable |
| Fedora | log4net | 44 | 0:3.5.0-1.fc44 | fixed |
| Fedora | nant | 44 | 1:0.92-43.fc44 | fixed |
| Fedora | log4net | 43 | 0:3.5.0-1.fc43 | fixed |
| Fedora | nant | 43 | 1:0.92-43.fc43 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Fedora | log4net | rpm | 44 | 0:3.5.0-1.fc44 | Not reported | FEDORA-2026-0BF84C3130#CVE-2026-105242 | Not reported |
| Fedora | nant | rpm | 44 | 1:0.92-43.fc44 | Not reported | FEDORA-2026-0BF84C3130#CVE-2026-105242 | Not reported |
| Fedora | log4net | rpm | 43 | 0:3.5.0-1.fc43 | Not reported | FEDORA-2026-588BC7E01C#CVE-2026-105242 | Not reported |
| Fedora | nant | rpm | 43 | 1:0.92-43.fc43 | Not reported | FEDORA-2026-588BC7E01C#CVE-2026-105242 | Not reported |
OpenFactory catalog packages
[Debian 13 (Trixie)]
- [liblog4net1.2-cil]Affected
Source package: [log4net]
Details (2)
1.2.10+dfsg-9· all · trixieAffected
pypi · log4net · debian · 13
1.2.10+dfsg-9· all · trixieAffected
pypi · log4net · debian · 13
- [liblog4net-cil-dev]Affected
Source package: [log4net]
Details (2)
1.2.10+dfsg-9· all · trixieAffected
pypi · log4net · debian · 13
1.2.10+dfsg-9· all · trixieAffected
pypi · log4net · debian · 13
[Fedora 43]
- [log4net]Unknown
Source package: [log4net]
Details (2)
2.0.8-23.fc43· aarch64 · 43Unknown
Version impact unknown
pypi · log4net · fedora · 43
2.0.8-23.fc43· x86_64 · 43Unknown
Version impact unknown
pypi · log4net · fedora · 43
- [log4net-devel]Unknown
Source package: [log4net]
Details (3)
2.0.8-23.fc43· aarch64 · 43Unknown
Version impact unknown
pypi · log4net · fedora · 43
2.0.8-23.fc43· i686 · 43Unknown
Version impact unknown
pypi · log4net · fedora · 43
2.0.8-23.fc43· x86_64 · 43Unknown
Version impact unknown
pypi · log4net · fedora · 43
- [nant]Unknown
Source package: [nant]
Details (2)
1:0.92-40.fc43· aarch64 · 43Unknown
Version impact unknown
pypi · nant · fedora · 43
1:0.92-40.fc43· x86_64 · 43Unknown
Version impact unknown
pypi · nant · fedora · 43
- [nant-devel]Unknown
Source package: [nant]
Details (3)
1:0.92-40.fc43· aarch64 · 43Unknown
Version impact unknown
pypi · nant · fedora · 43
1:0.92-40.fc43· i686 · 43Unknown
Version impact unknown
pypi · nant · fedora · 43
1:0.92-40.fc43· x86_64 · 43Unknown
Version impact unknown
pypi · nant · fedora · 43
- [nant-docs]Unknown
Source package: [nant]
Details (2)
1:0.92-40.fc43· aarch64 · 43Unknown
Version impact unknown
pypi · nant · fedora · 43
1:0.92-40.fc43· x86_64 · 43Unknown
Version impact unknown
pypi · nant · fedora · 43
[Fedora 44]
- [log4net]Unknown
Source package: [log4net]
Details (2)
2.0.8-24.fc44· aarch64 · 44Unknown
Version impact unknown
pypi · log4net · fedora · 44
2.0.8-24.fc44· x86_64 · 44Unknown
Version impact unknown
pypi · log4net · fedora · 44
- [log4net-devel]Unknown
Source package: [log4net]
Details (3)
2.0.8-24.fc44· aarch64 · 44Unknown
Version impact unknown
pypi · log4net · fedora · 44
2.0.8-24.fc44· i686 · 44Unknown
Version impact unknown
pypi · log4net · fedora · 44
2.0.8-24.fc44· x86_64 · 44Unknown
Version impact unknown
pypi · log4net · fedora · 44
- [nant]Unknown
Source package: [nant]
Details (2)
1:0.92-41.fc44· aarch64 · 44Unknown
Version impact unknown
pypi · nant · fedora · 44
1:0.92-41.fc44· x86_64 · 44Unknown
Version impact unknown
pypi · nant · fedora · 44
- [nant-devel]Unknown
Source package: [nant]
Details (3)
1:0.92-41.fc44· aarch64 · 44Unknown
Version impact unknown
pypi · nant · fedora · 44
1:0.92-41.fc44· i686 · 44Unknown
Version impact unknown
pypi · nant · fedora · 44
1:0.92-41.fc44· x86_64 · 44Unknown
Version impact unknown
pypi · nant · fedora · 44
- [nant-docs]Unknown
Source package: [nant]
Details (2)
1:0.92-41.fc44· aarch64 · 44Unknown
Version impact unknown
pypi · nant · fedora · 44
1:0.92-41.fc44· x86_64 · 44Unknown
Version impact unknown
pypi · nant · fedora · 44
Observed:
References
- [https://bodhi.fedoraproject.org/updates/FEDORA-2026-588bc7e01c]
- [https://bugzilla.redhat.com/show_bug.cgi?id=2457917]
- [https://bugzilla.redhat.com/show_bug.cgi?id=2547384]
- [https://bugzilla.redhat.com/show_bug.cgi?id=2547386]
- [https://bugzilla.redhat.com/show_bug.cgi?id=2547388]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-105242]
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105242.json]
[FIRST EPSS] · [Fedora security updates (Bodhi)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]