Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net. (CVE-2026-105241)

The vulnerability in Apache log4net's SmtpPickupDirAppender arises from improper handling of Unicode encoding. When the mail file writer encounters content it cannot encode, such as an unpaired UTF-16 surrogate, it throws an exception. This causes all buffered events in the batch to be discarded, not just the problematic event, and may leave a truncated mail file in the pickup directory. Consequently, an attacker who can inject data into log messages could suppress logging of other events. This issue affects log4net versions from 1.2.9 before 3.5.0. The vendor fixed the issue in version 3.5.0.

The vulnerability allows suppression of log records by causing the mail writer to fail and discard all buffered events in a batch. This can lead to loss of log data and truncated mail files in the pickup directory. There is no direct confidentiality or availability impact, but integrity of logging is affected. Only applications using the SmtpPickupDirAppender are impacted.

Users should upgrade Apache log4net to version 3.5.0 or later, where this issue is fixed. No other mitigations are indicated. The vendor advisory confirms that upgrading to 3.5.0 resolves the problem.