CVE-2026-105242

Executive Summary

CVE-2026-105242 is an improper handling of exceptional conditions (CWE-755) vulnerability in the aspnet-request pattern converter of Apache log4net. It affects only applications built on ASP.NET for .NET Framework whose logging layouts explicitly use the %aspnet-request conversion pattern. An unauthenticated remote sender can embed content—such as markup—in a request that triggers ASP.NET request validation, causing the layout to throw an exception and the appender to discard the entire log event, thereby suppressing the log record of the sender's own request. With a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), the impact is limited to integrity of the logging pipeline—specifically the loss of audit records—rather than confidentiality or availability of the application itself.

Technical Analysis

Apache log4net is a widely deployed logging framework for the .NET ecosystem, and its pattern layout engine supports conversion patterns that pull values from ambient context. The %aspnet-request pattern converter reads request parameters and surfaces them into the rendered log message. On ASP.NET for .NET Framework, reading request parameters is an operation that passes through the platform's built-in request validation subsystem.

Request validation is a defense-in-depth feature of classic ASP.NET that inspects incoming request data for potentially dangerous markup and raises an exception when such content is found. The core defect here is that the aspnet-request pattern converter performs this parameter read inside the logging layout's rendering path without safely handling the resulting exception. When a request contains content that trips request validation—for example markup—the layout rendering throws.

Because the throw occurs inside the appender's write path rather than in application code, the exception propagates in a way that causes the appender to abandon the current event. The whole event is discarded, not merely the offending converted field. The practical consequence is that the very request that carries the triggering content is the request whose log record is silently dropped. An attacker therefore does not need to disable logging infrastructure, alter configuration, or gain any privilege: they simply shape the input of their own request such that the logging of that request fails.

This is a narrow but important class of failure: an attacker-controlled input path that terminates the audit record for the attacker's own activity. It is a logging-integrity and observability problem rather than a memory-safety or code-execution problem. The NVD description explicitly constrains the affected population to applications running on ASP.NET for .NET Framework, and only those whose logging layout actually uses the %aspnet-request conversion pattern. Applications on .NET (Core) / modern .NET, applications that do not include %aspnet-request in their layout, and applications that use log4net solely for non-request logging are not affected by this specific mechanism.

The vulnerability is tracked under CWE-755, "Improper Handling of Exceptional Conditions," which is consistent with the described mechanism: an exceptional condition (a request-validation exception) is neither caught nor gracefully degraded, and the failure mode cascades into loss of the surrounding event. The affected range is log4net from 1.2.11 before 3.5.0. No public proof-of-concept, Nuclei template, or exploit code is known, and the issue is not listed in CISA KEV. FIRST.org has not yet assigned an EPSS score.

Exploitation Scenarios

The attack chain for this vulnerability is inferred from the vulnerability class (CWE-755 improper handling of exceptional conditions) and the behavior described in the NVD text. No public PoC is available, and no specific implementation artifacts—function names, endpoints, or parameters beyond the documented %aspnet-request pattern—are asserted here.

1. Reconnaissance / target identification. The attacker must first identify an ASP.NET for .NET Framework application that uses Apache log4net in the affected range (1.2.11 through versions before 3.5.0) and, critically, configures a layout that includes the %aspnet-request conversion pattern. This is a deployment-specific property. It may be inferred from application fingerprints, from error page behavior, or from knowledge of the target's stack; it is not something the attacker can assume universally, since the affected population is explicitly limited.

2. Triggering the flaw class. With the target identified, the attacker sends a request to the application that includes content designed to be caught by ASP.NET request validation—markup being the example given in the NVD description. When log4net's aspnet-request pattern converter reads the request parameters to populate the log record, request validation raises an exception. Because the layout does not properly handle this exceptional condition, the throw interrupts rendering.

3. Execution / effect at the vulnerability-class level. The exception propagates out of the layout into the appender's write path. The appender discards the entire event rather than emitting a partial or sanitized record. The attacker's request is still processed by the application normally; the only thing that fails is the generation of its log entry. There is no payload execution, code injection, or privilege escalation—the "payload" is simply input crafted to be exceptional to the logging conversion path.

4. Post-exploitation impact. The attacker achieves suppression of the audit record associated with their own request. If that request is itself part of a broader malicious activity (for example, probing or exploitation of a separate flaw in the same application), the corresponding log line does not reach the configured sink. Repeated use allows an attacker to generate activity that is systematically absent from application logs, degrading detection, incident reconstruction, and forensic timelines. The impact is confined to log integrity; confidentiality and availability are not affected per the CVSS vector.

Note: Because the affected layout configuration is environment-specific and no exploit code is public, real-world exploitation requires the attacker to both find a qualifying target and understand that its layout uses %aspnet-request. This is a realistic but non-trivial precondition, which is consistent with the "integrity: low" CVSS assessment rather than a high-impact rating.

Impact Assessment

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) yields 5.3 Medium and describes the impact precisely:

• Attack Vector (Network, N): Exploitable remotely; no local access is required.
• Attack Complexity (Low, L): No special conditions beyond the deployment precondition (a layout using %aspnet-request on ASP.NET for .NET Framework). Once that precondition holds, triggering is straightforward.
• Privileges Required (None, N): The attacker needs no authentication; the request is unauthenticated.
• User Interaction (None, N): No victim action is required.
• Scope (Unchanged, U): The effect stays within the vulnerable component's security authority.
• Confidentiality (None, C:N): No data disclosure results from this flaw directly.
• Integrity (Low, I:L): The integrity of the logging record set is compromised—records can be selectively suppressed.
• Availability (None, A:N): The application remains available; only the log event is dropped, not the service.

Business impact. The primary consequence is loss of audit fidelity for a targeted subset of requests. In regulated environments where application logs feed compliance, security monitoring, or forensic investigation, the ability to selectively blank out records for attacker-controlled requests undermines non-repudiation and detection. For SOC teams, this is a blind-spot class defect: the absence of evidence is not visible as an error in the log stream unless log4net's own error handling is configured to surface layout failures.

Blast radius. Architecturally, log4net is embedded in the application, so the blast radius is bounded by how many in-scope ASP.NET for .NET Framework applications (a) run affected versions and (b) use %aspnet-request in their layouts. Legacy and long-lived enterprise web applications on classic ASP.NET are the likeliest candidates. Modern .NET deployments and non-ASP.NET .NET applications are out of scope for this mechanism. There is no supply-chain propagation component in the described behavior, and no KEV listing indicates no known active exploitation at the time of writing.

Detection Guidance

Sigma Rule

title: Apache log4net aspnet-request Pattern Converter Exception - Log Event Suppression
id: 7b3a1c92-4f1e-4a0b-9a2d-1f6c8e5d2a10
status: experimental
description: Detects ASP.NET request validation exceptions arising from the log4net
  aspnet-request pattern converter, which causes the appender to discard the event
  and can be used to suppress an attacker-controlled request's log record
  (CVE-2026-105242).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105242
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.defense-evasion
  - attack.t1562.002
  - cve.2026.105242
logsource:
  product: windows
  service: application
detection:
  selection_source:
    Provider_Name: 'ASP.NET'
  selection_message:
    - 'Exception message: A potentially dangerous Request'
    - 'Request Validation'
    - 'log4net'
  selection_converter:
    - '%aspnet-request'
    - 'aspnet-request'
  condition: selection_source and (selection_message or selection_converter)
falsepositives:
  - Legitimate user input containing angle brackets reaching request validation
  - Application forms that intentionally accept rich text on trusted intranet sites
level: medium

YARA Rule

rule CVE_2026_105242_log4net_aspnet_request_layout
{
    meta:
        description = "Detects log4net configuration referencing the aspnet-request pattern converter, the precondition for CVE-2026-105242"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105242"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $conv1 = "%aspnet-request" ascii wide nocase
        $conv2 = "aspnet-request" ascii wide nocase
        $cfg1  = "<layout" ascii wide nocase
        $cfg2  = "log4net" ascii wide nocase

    condition:
        (uint16(0) == 0x5A4D or uint32(0) == 0x464C457F or
         $cfg2 or $conv1) and
        $conv2 and
        ($cfg1 or $cfg2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105242 Apache log4net aspnet-request request validation log suppression attempt"; flow:established,to_server; method:GET,POST; http.request_body; content:"<"; pcre:"/<[a-zA-Z\/!]/R"; http.uri; content:"%3C"; nocase; threshold:type limit, track by_src, count 10, seconds 60; reference:cve,2026-105242; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105242; classtype:attempted-recon; sid:2026105242; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [any where event.category == "web" and http.request.method in ("GET","POST") and
     wildcard(http.request.body.text, "*<*")]
  [any where event.category == "web" and
     (wildcard(log.level, "*ERROR*") or wildcard(log.level, "*WARN*")) and
     wildcard(message, "*aspnet-request*") and
     (wildcard(message, "*Request Validation*") or
      wildcard(message, "*potentially dangerous*"))]

Splunk SPL Query

index=app_logs (source="*log4net*" OR source="*aspnet*")
    ("%aspnet-request" OR "aspnet-request" OR "Request Validation" OR "A potentially dangerous Request")
| eval client=coalesce(src_ip, clientip, c_ip)
| stats count min(_time) as first_seen max(_time) as last_seen values(message) as messages by client, host
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="apache_log4net,cve-2026-105242,web,">
  <rule id="105242" level="8">
    <decoded_as>json</decoded_as>
    <field name="message">%aspnet-request</field>
    <description>CVE-2026-105242: log4net aspnet-request pattern converter exception - possible log event suppression attempt.</description>
    <mitre>
      <id>T1562.002</id>
    </mitre>
  </rule>

  <rule id="105243" level="10">
    <if_sid>105242</if_sid>
    <field name="message">Request Validation|A potentially dangerous Request</field>
    <description>CVE-2026-105242: ASP.NET request validation triggered within log4net layout - attacker may be suppressing their own request log record.</description>
    <mitre>
      <id>T1562.002</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor-supplied workarounds were provided in the source data.

1. Immediate mitigations. Because the affected population is narrowly defined, the first step is to determine exposure. Inventory ASP.NET for .NET Framework applications that reference Apache log4net in the affected range (1.2.11 before 3.5.0) and inspect their log4net layout configuration for the %aspnet-request conversion pattern. Where such a layout exists and cannot be immediately changed, the most direct mitigation is to remove or replace %aspnet-request in the layout so that the request-parameter read—and therefore the request-validation exception path—is no longer exercised during rendering. This eliminates the mechanism entirely. Additionally, review ASP.NET request validation settings; while disabling request validation broadly is not advisable, understanding whether validation is active and how exceptions are surfaced helps scope true exposure. Ensure log4net's internal error handling is configured to emit a diagnostic when a layout renders an event's failure, so silently discarded records are at least detectable as errors rather than invisible.

2. Patch / upgrade steps. The NVD description states the issue affects log4net from 1.2.11 before 3.5.0 and that users are recommended to upgrade to version 3.5.0, which fixes the issue. The remediation is a dependency upgrade to log4net 3.5.0 or later. This requires rebuilding and redeploying the affected ASP.NET for .NET Framework applications with the updated assembly reference and re-verifying that layouts using %aspnet-request now render correctly and degrade gracefully when request validation raises. Because patch evidence was not corroborated by any tracked source at the time of this report, organizations should independently verify the fix by testing the %aspnet-request layout against requests containing markup in a non-production environment before and after upgrading.

3. Long-term hardening. Treat logging pipelines as security-critical inputs. Avoid including raw, attacker-controllable request parameters directly in log layouts where a platform subsystem can raise exceptions on that content; prefer structured logging with explicit, sanitized field capture. Establish dependency governance so the log4net version is tracked and upgraded through normal patch cycles. Configure appenders and error handlers to alert when events are dropped or when layout rendering fails, closing the observability gap this class of defect creates. Finally, ensure detection coverage (as in the guidance above) correlates validation-exception telemetry with request sources, so that attempts to suppress audit records are themselves visible.

References

• NVD — CVE-2026-105242: https://nvd.nist.gov/vuln/detail/CVE-2026-105242
• Apache log4net project: https://logging.apache.org/log4net/
• MITRE CWE-755 — Improper Handling of Exceptional Conditions: https://cwe.mitre.org/data/definitions/755.html
• MITRE ATT&CK T1562.002 — Impair Defenses: Disable Windows Event Logging: https://attack.mitre.org/techniques/T1562/002/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-105242 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, exploit code, or Nuclei template was identified for this CVE at the time of writing. No threat actor campaign or exploit-in-the-wild evidence has been reported, and the vulnerability is not present in CISA KEV. FIRST.org has not yet published an EPSS score for this CVE.