CVE-2026-105242
Description
A flaw was found in log4net. A remote attacker can exploit this issue by sending a crafted request containing content such as markup that triggers ASP.NET request validation. When log4net attempts to parse the request parameters, an unhandled exception occurs, causing the logging system to discard the entire log event. Consequently, an attacker can suppress log records of their own requests and evade security monitoring.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Understanding the Weakness (CWE)
Non-Repudiation
Technical Impact: Hide Activities
Malicious behavior can become more difficult to detect, such as a failed login attempt. This may hinder forensic analysis after an attack succeeds. There will be no trail for forensic analysis, and discovering the cause of problems or the source of attacks may become more difficult or impossible.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
