As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-105241: Apache log4net: Unencodable content discards a whole SmtpPickupDirAppender batch
CVE-2026-105241 affects Apache log4net versions before 3.5.0 and identifies an improper handling of Unicode encoding vulnerability in the SmtpPickupDirAppender component. When the mail file writer encounters unencodable content, such as unpaired UTF-16 sequences, it discards an entire batch of Simple Mail Transfer Protocol (SMTP) pickup directory appender messages instead of handling the error gracefully.
Why it matters: Applications using Apache log4net's SMTP pickup directory appender for email logging may silently lose log messages when encountering certain character encoding issues, affecting audit trails and visibility into application behavior. Practitioners should patch to version 3.5.0 or later to prevent message loss.
- Source published
- First seen by Cybersecurity Tracker