CVE-2026-105243

Executive Summary

CVE-2026-105243 is an insufficient logging vulnerability (CWE-778) in the EventLogAppender component of Apache log4net. A party whose data reaches a log message can suppress the entire log record on Windows by making the message long enough, because long messages are truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted — the event log then stores nothing and reports nothing. Only applications running on Windows that use EventLogAppender are affected; the issue spans log4net 1.2.9 through versions before 3.5.0.

Technical Analysis

Apache log4net is a logging framework for .NET. Its EventLogAppender writes application log records into the Windows Event Log. The vulnerability resides in the message handling path: log messages were truncated to a fixed maximum size. That configured/truncation size did not account for the additional bytes consumed by the Windows Event Log entry itself — specifically the log name and source name that accompany every event. When the combined payload (truncated message plus log/source metadata) exceeds what the Windows Event Log API accepts, the write fails silently: the event log stores nothing and reports nothing.

The security consequence is a data-integrity and visibility failure in the logging subsystem. Because suppression is driven by attacker-influenced input rather than by a privileged configuration change, an adversary who can get their data into a log message can make that message long enough to cause the entire record — including the security-relevant content a defender or SIEM would otherwise consume — to be dropped without any error surfaced to the application or operator.

The description scopes the flaw precisely: it affects only applications on Windows that use EventLogAppender. Other appenders and non-Windows deployments are out of scope per the advisory text. The affected range is Apache log4net from 1.2.9 before 3.5.0.

No public PoC, Nuclei template, or exploit code is available for this CVE, and no CNA title or additional code-level identifiers were provided in the source data. The mechanism above is described strictly at the level the advisory supports; specific method names, truncation constants, and the exact Windows API failure path are not enumerated in the provided description and are therefore not asserted here.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class (CWE-778, insufficient logging). The advisory states an attacker suppresses records by controlling data that reaches a log message and making it long enough.

1. Reconnaissance / target identification: The adversary identifies a Windows application that logs to the Windows Event Log via Apache log4net's EventLogAppender and where attacker-supplied data is written into log messages (for example, user-controlled request fields, identifiers, or error text that get logged). The attack surface is any input path that ultimately flows into an EventLogAppender log call.

2. Triggering the flaw class: The adversary submits data crafted to be long enough that, after the fixed-size truncation and the accounting for the log and source names, the resulting event exceeds the size the Windows Event Log accepts. Per the advisory, the truncation ceiling was set too high relative to that limit.

3. Execution method (class level): Delivery is via ordinary input to the affected application — no authentication or special access is required for the logging-suppression behavior itself, consistent with the CVSS vector (AV:N, PR:N, UI:N). The maliciously long value is carried into the log statement, where truncation fails to bring the payload within the Windows Event Log's acceptable size.

4. Post-exploitation impact: The targeted log entry — and, per the description, the whole record — is silently discarded and never reported. An attacker can use this to suppress evidence associated with their activity, degrading audit fidelity and blinding downstream collection. The advisory does not describe code execution, data disclosure, or alteration of unrelated records; the impact is confined to integrity of logging output. CWE-778 classifies this as insufficient logging, and the CVSS vector assigns confidentiality None, integrity Low, availability None (base 5.3).

Impact Assessment

The CVSS 3.1 base score is 5.3 (Medium), with subscores: Attack Vector Network, Attack Complexity Low, Privileges Required None, User Interaction None, Scope Unchanged, Confidentiality None, Integrity Low, Availability None. The integrity impact reflects the ability to cause security-relevant log records to be dropped without detection by the logging stack itself.

Business impact centers on audit and forensic blind spots on Windows systems. Organizations that rely on Windows Event Log ingestion — forwarding into a SIEM — may find that crafted inputs cause specific records to never arrive, defeating alerting and investigation. Because the suppression produces no error, the failure is silent, and defenders cannot assume absence of a record means absence of activity.

Blast radius is limited to the affected Windows applications and the events they emit through EventLogAppender. The scope is unchanged, so unrelated components are not implicated. Non-Windows deployments and Windows applications that do not use this appender are not affected per the advisory. No CISA KEV listing and no EPSS score is available (FIRST.org has not yet scored this CVE; no EPSS value is asserted).

Exploitation complexity is low once an input path into a log message is identified, but the realized effect is suppression of records rather than broader system compromise. The real risk is operational: corrupted or missing audit trails that undermine incident response, compliance reporting, and detection coverage.

Detection Guidance

Sigma Rule

title: Potential Apache log4net EventLogAppender Log Suppression (CVE-2026-105243)
id: 9f3c1a2e-7b4d-4c8e-9a10-2d5f6e7a8b90
status: experimental
description: >
  Detects anomalous write failures / gaps in Windows Event Log ingestion that may
  indicate suppression of log4net EventLogAppender records via overly long messages
  (CVE-2026-105243). Correlate application log gaps with inputs exceeding expected
  message lengths.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105243
author: valtersit.com
date: 2026/01/01
tags:
  - attack.defense-evasion
  - attack.t1562.002
  - cve.2026-105243
logsource:
  product: windows
  service: application
detection:
  selection:
    Provider_Name: 'log4net'
  filter_errors:
    Level: 'Error'
    EventID:
      - 0
      - 00
  condition: selection and not filter_errors
falsepositives:
  - Legitimate application errors during log initialization
  - Rolling log configuration changes
level: medium

YARA Rule

rule CVE_2026_105243_log4net_EventLogAppender_Config
{
    meta:
        description = "Detects log4net EventLogAppender configuration/DLL referencing affected component; heuristic for CVE-2026-105243 exposure on Windows hosts"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105243"
        cve = "CVE-2026-105243"

    strings:
        $s1 = "EventLogAppender" ascii wide nocase
        $s2 = "log4net" ascii wide nocase
        $s3 = "log4net.dll" ascii wide nocase
        $s4 = "log4net.config" ascii wide nocase
        $s5 = "EventLogAppender" ascii

    condition:
        uint16(0) == 0x5A4D and any of ($s*) or
        (filesize < 5MB and 2 of them)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105243 Potential log4net EventLogAppender log suppression via oversized input"; flow:to_server,established; http.request_body; content:"|20|"; depth:0; byte_test:0,>,8000,0,string; reference:cve,2026-105243; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105243; classtype:attempted-recon; sid:2026105243; rev:1; metadata:affected_product Apache_log4net, created_at 2026_01_01, cve CVE_2026_105243;)

Elastic Detection

process where event.type == "start" and process.name : ("*App*.exe", "*Service*.exe")
and process.parent.name : ("w3wp.exe", "dotnet.exe")
and not process.args : ("--help", "--version")

sequence by host.id with maxspan=5m
  [ any where event.category == "process" ]
  [ file where file.name : ("*.log", "log4net.config") and file.path : "C:*" ]

Splunk SPL Query

index=windows EventCode=0 OR EventCode=1 Host="*"
| eval msg_len=len(Message)
| where isnull(Message) OR msg_len < 10
| stats count as suppressed_candidates by host, SourceName, Provider_Name
| where suppressed_candidates > 5
| sort - suppressed_candidates
| table host, SourceName, Provider_Name, suppressed_candidates

index=windows Provider_Name="log4net" OR SourceName="log4net"
| where isnull(Message) OR len(Message)=0
| bucket _time span=5m
| stats count by _time, host
| eventstats avg(count) as avg_count stdev(count) as sd by host
| where count < (avg_count - 2*sd)

Wazuh OSSEC Rule

<group name="windows,log4net,cve-2026-105243,">
  <rule id="105243" level="10">
    <if_sid>60000</if_sid>
    <field name="Provider_Name">log4net</field>
    <field name="Message">^$|^null$</field>
    <description>CVE-2026-105243: Possible empty/log4net EventLogAppender record suppressed on Windows (log4net EventLogAppender insufficient logging)</description>
    <mitre>
      <id>T1562.002</id>
    </mitre>
    <group>defense_evasion,</group>
  </rule>

  <rule id="105244" level="12">
    <if_sid>105243</if_sid>
    <same_source_ip />
    <description>CVE-2026-105243: Repeated suppressed log4net EventLogAppender records from same source</description>
    <mitre>
      <id>T1562.002</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The advisory text states that version 3.5.0 fixes the issue; however, no vendor fix, workaround, or patch artifact was present in the tracked patch sources, so verification against the upstream advisory is required before treating any build as remediated.

1. Immediate mitigations:

• Inventory Windows applications and services that use Apache log4net and specifically the EventLogAppender; these are the only affected targets.
• Where feasible without code changes, reconfigure logging to route security-relevant events to an appender other than EventLogAppender, or mirror events to a file/SIEM appender, so records are not solely dependent on the Windows Event Log path.
• Constrain the size of untrusted data that can reach log messages (input validation / length limits on request fields, identifiers, and error text), reducing the attacker's ability to construct a message long enough to trigger suppression. The advisory attributes suppression to message length, so controlling maximum logged input length directly mitigates the condition.
• Alert on gaps in expected event flow and on empty/missing records rather than relying solely on record presence.

2. Patch/upgrade steps:

• Plan an upgrade to Apache log4net 3.5.0, which the advisory states fixes the issue.
• Confirm the installed log4net version in each affected application (the flaw affects versions 1.2.9 through before 3.5.0) and track the dependency where it is bundled or vendored.
• Because patch confidence is 0/4, validate the fix against the official log4net 3.5.0 release notes and the Apache security advisory before closing remediation.

3. Long-term hardening:

• Apply the principle of not letting raw, unbounded user input flow into log statements; enforce per-field and per-message length limits at log boundaries.
• Build monitoring that treats logging subsystem gaps as a security event (defense evasion), so silent failure becomes visible.
• Maintain software composition visibility for .NET dependencies, including log4net, and subscribe to Apache security announcements to catch future advisories promptly.
• Periodically test that log records are actually landing in the Windows Event Log and downstream SIEM under adversarial input conditions.

References

• NVD — CVE-2026-105243: https://nvd.nist.gov/vuln/detail/CVE-2026-105243
• Apache log4net security advisories (project): https://logging.apache.org/log4net/
• MITRE ATT&CK T1562.002 — Impair Defenses: Disable Windows Event Logging: https://attack.mitre.org/techniques/T1562/002/
• CWE-778 — Insufficient Logging: https://cwe.mitre.org/data/definitions/778.html
• CISA Known Exploited Vulnerabilities Catalog (no KEV entry for CVE-2026-105243 as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence were identified in the provided data. PoC status: None. Nuclei template: No. Exploit code: No. CISA KEV: No. EPSS: not yet scored by FIRST.org.