You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@logging.apache.org by gi...@apache.org on 2026/10/06 19:57:53 UTC
(logging-site) branch main-site-stg-out updated: Add website content generated from `15505b509ba025e2a4a443bf5cd791f319a48224`
This is an automated email from the ASF dual-hosted git repository.
github-actions[bot] pushed a commit to branch main-site-stg-out
in repository https://gitbox.apache.org/repos/asf/logging-site.git
The following commit(s) were added to refs/heads/main-site-stg-out by this push:
new 7697161b Add website content generated from `15505b509ba025e2a4a443bf5cd791f319a48224`
7697161b is described below
commit 7697161bcc9d49f1a158a5dd0134446940acf0c1
Author: ASF Logging Services RM <pr...@logging.apache.org>
AuthorDate: Tue Oct 6 19:57:47 2026 +0000
Add website content generated from `15505b509ba025e2a4a443bf5cd791f319a48224`
---
404.html | 2 +-
blog/20231117-flume-joins-logging-services.html | 2 +-
blog/20231128-new-pmc-member.html | 2 +-
blog/20231202-apache-common-logging-1.3.0.html | 2 +-
blog/20231214-announcing-support-from-the-stf.html | 2 +-
blog/20231218-20-years-of-innovation.html | 2 +-
...20240725-Log4j-At-Community-Over-Code-2024.html | 2 +-
blog/20240808-welcome-to-the-pmc-jan.html | 2 +-
blog/20240812-log4j-bug-bounty.html | 2 +-
blog/20250728-introduction-to-vex-files.html | 2 +-
blog/index.html | 2 +-
charter.html | 2 +-
cyclonedx/vdr.xml | 310 +++++++++++++++-
download.html | 2 +-
guidelines.html | 2 +-
index.html | 2 +-
processes.html | 2 +-
security.html | 410 ++++++++++++++++++++-
security/faq.html | 2 +-
sitemap.xml | 42 +--
support.html | 2 +-
team-list.html | 2 +-
what-is-logging.html | 2 +-
xml/ns/index.html | 2 +-
24 files changed, 759 insertions(+), 45 deletions(-)
diff --git a/404.html b/404.html
index 53950202..29d2a800 100644
--- a/404.html
+++ b/404.html
@@ -4,7 +4,7 @@
<meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Page Not Found :: Apache Logging Services</title>
- <meta name="generator" content="Antora 3.2.0">
+ <meta name="generator" content="Antora 3.2.1">
<link rel="stylesheet" href="/_/css/site.css">
<link rel="icon" href="/_/../_images/favicon.ico" type="image/x-icon">
<!-- `@asciidoctor/tabs` extension styles -->
diff --git a/blog/20231117-flume-joins-logging-services.html b/blog/20231117-flume-joins-logging-services.html
index c61dd028..9074d25e 100644
--- a/blog/20231117-flume-joins-logging-services.html
+++ b/blog/20231117-flume-joins-logging-services.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Welcoming the Apache Flume Team to Apache Logging Services :: Apache Logging Services</title>
<link rel="canonical" href="https://logging.apache.org/blog/20231117-flume-joins-logging-services.html">
- <meta name="generator" content="Antora 3.2.0">
+ <meta name="generator" content="Antora 3.2.1">
<link rel="stylesheet" href="../_/css/site.css">
<link rel="icon" href="../_/../_images/favicon.ico" type="image/x-icon">
<!-- `@asciidoctor/tabs` extension styles -->
diff --git a/blog/20231128-new-pmc-member.html b/blog/20231128-new-pmc-member.html
index d66980c5..9602517f 100644
--- a/blog/20231128-new-pmc-member.html
+++ b/blog/20231128-new-pmc-member.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Welcoming Stephen Webb to the Apache Logging Services community :: Apache Logging Services</title>
<link rel="canonical" href="https://logging.apache.org/blog/20231128-new-pmc-member.html">
- <meta name="generator" content="Antora 3.2.0">
+ <meta name="generator" content="Antora 3.2.1">
<link rel="stylesheet" href="../_/css/site.css">
<link rel="icon" href="../_/../_images/favicon.ico" type="image/x-icon">
<!-- `@asciidoctor/tabs` extension styles -->
diff --git a/blog/20231202-apache-common-logging-1.3.0.html b/blog/20231202-apache-common-logging-1.3.0.html
index 9aba5398..4156f393 100644
--- a/blog/20231202-apache-common-logging-1.3.0.html
+++ b/blog/20231202-apache-common-logging-1.3.0.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Apache Commons Logging :: Apache Logging Services</title>
<link rel="canonical" href="https://logging.apache.org/blog/20231202-apache-common-logging-1.3.0.html">
- <meta name="generator" content="Antora 3.2.0">
+ <meta name="generator" content="Antora 3.2.1">
<link rel="stylesheet" href="../_/css/site.css">
<link rel="icon" href="../_/../_images/favicon.ico" type="image/x-icon">
<!-- `@asciidoctor/tabs` extension styles -->
diff --git a/blog/20231214-announcing-support-from-the-stf.html b/blog/20231214-announcing-support-from-the-stf.html
index dbe71f12..2b1b62fd 100644
--- a/blog/20231214-announcing-support-from-the-stf.html
+++ b/blog/20231214-announcing-support-from-the-stf.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Receiving Support from the Sovereign Tech Fund :: Apache Logging Services</title>
<link rel="canonical" href="https://logging.apache.org/blog/20231214-announcing-support-from-the-stf.html">
- <meta name="generator" content="Antora 3.2.0">
+ <meta name="generator" content="Antora 3.2.1">
<link rel="stylesheet" href="../_/css/site.css">
<link rel="icon" href="../_/../_images/favicon.ico" type="image/x-icon">
<!-- `@asciidoctor/tabs` extension styles -->
diff --git a/blog/20231218-20-years-of-innovation.html b/blog/20231218-20-years-of-innovation.html
index 59a82d34..f2865a8f 100644
--- a/blog/20231218-20-years-of-innovation.html
+++ b/blog/20231218-20-years-of-innovation.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Two Decades of Log4j: A Journey of Resilience and Innovation :: Apache Logging Services</title>
<link rel="canonical" href="https://logging.apache.org/blog/20231218-20-years-of-innovation.html">
- <meta name="generator" content="Antora 3.2.0">
+ <meta name="generator" content="Antora 3.2.1">
<link rel="stylesheet" href="../_/css/site.css">
<link rel="icon" href="../_/../_images/favicon.ico" type="image/x-icon">
<!-- `@asciidoctor/tabs` extension styles -->
diff --git a/blog/20240725-Log4j-At-Community-Over-Code-2024.html b/blog/20240725-Log4j-At-Community-Over-Code-2024.html
index 57194ea6..3162934c 100644
--- a/blog/20240725-Log4j-At-Community-Over-Code-2024.html
+++ b/blog/20240725-Log4j-At-Community-Over-Code-2024.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Log4j at Community Over Code 2024 in Bratislava :: Apache Logging Services</title>
<link rel="canonical" href="https://logging.apache.org/blog/20240725-Log4j-At-Community-Over-Code-2024.html">
- <meta name="generator" content="Antora 3.2.0">
+ <meta name="generator" content="Antora 3.2.1">
<link rel="stylesheet" href="../_/css/site.css">
<link rel="icon" href="../_/../_images/favicon.ico" type="image/x-icon">
<!-- `@asciidoctor/tabs` extension styles -->
diff --git a/blog/20240808-welcome-to-the-pmc-jan.html b/blog/20240808-welcome-to-the-pmc-jan.html
index 17574eaf..4945a078 100644
--- a/blog/20240808-welcome-to-the-pmc-jan.html
+++ b/blog/20240808-welcome-to-the-pmc-jan.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Welcoming Jan Friedrich to the Apache Logging Services PMC :: Apache Logging Services</title>
<link rel="canonical" href="https://logging.apache.org/blog/20240808-welcome-to-the-pmc-jan.html">
- <meta name="generator" content="Antora 3.2.0">
+ <meta name="generator" content="Antora 3.2.1">
<link rel="stylesheet" href="../_/css/site.css">
<link rel="icon" href="../_/../_images/favicon.ico" type="image/x-icon">
<!-- `@asciidoctor/tabs` extension styles -->
diff --git a/blog/20240812-log4j-bug-bounty.html b/blog/20240812-log4j-bug-bounty.html
index 252622d2..dd18f778 100644
--- a/blog/20240812-log4j-bug-bounty.html
+++ b/blog/20240812-log4j-bug-bounty.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Log4j participates in the bug bounty program :: Apache Logging Services</title>
<link rel="canonical" href="https://logging.apache.org/blog/20240812-log4j-bug-bounty.html">
- <meta name="generator" content="Antora 3.2.0">
+ <meta name="generator" content="Antora 3.2.1">
<link rel="stylesheet" href="../_/css/site.css">
<link rel="icon" href="../_/../_images/favicon.ico" type="image/x-icon">
<!-- `@asciidoctor/tabs` extension styles -->
diff --git a/blog/20250728-introduction-to-vex-files.html b/blog/20250728-introduction-to-vex-files.html
index feb4fc75..f99e031f 100644
--- a/blog/20250728-introduction-to-vex-files.html
+++ b/blog/20250728-introduction-to-vex-files.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>How I learned to Stop Worrying and Love the VEX :: Apache Logging Services</title>
<link rel="canonical" href="https://logging.apache.org/blog/20250728-introduction-to-vex-files.html">
- <meta name="generator" content="Antora 3.2.0">
+ <meta name="generator" content="Antora 3.2.1">
<link rel="stylesheet" href="../_/css/site.css">
<link rel="icon" href="../_/../_images/favicon.ico" type="image/x-icon">
<!-- `@asciidoctor/tabs` extension styles -->
diff --git a/blog/index.html b/blog/index.html
index fde0d4b3..e2a2e55b 100644
--- a/blog/index.html
+++ b/blog/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Blog :: Apache Logging Services</title>
<link rel="canonical" href="https://logging.apache.org/blog/index.html">
- <meta name="generator" content="Antora 3.2.0">
+ <meta name="generator" content="Antora 3.2.1">
<link rel="stylesheet" href="../_/css/site.css">
<link rel="icon" href="../_/../_images/favicon.ico" type="image/x-icon">
<!-- `@asciidoctor/tabs` extension styles -->
diff --git a/charter.html b/charter.html
index 71759da9..8076c351 100644
--- a/charter.html
+++ b/charter.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Charter :: Apache Logging Services</title>
<link rel="canonical" href="https://logging.apache.org/charter.html">
- <meta name="generator" content="Antora 3.2.0">
+ <meta name="generator" content="Antora 3.2.1">
<link rel="stylesheet" href="./_/css/site.css">
<link rel="icon" href="./_/../_images/favicon.ico" type="image/x-icon">
<!-- `@asciidoctor/tabs` extension styles -->
diff --git a/cyclonedx/vdr.xml b/cyclonedx/vdr.xml
index 861e5d77..78ba4ec8 100644
--- a/cyclonedx/vdr.xml
+++ b/cyclonedx/vdr.xml
@@ -40,11 +40,11 @@
<bom xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://cyclonedx.org/schema/bom/1.6"
xsi:schemaLocation="http://cyclonedx.org/schema/bom/1.6 https://cyclonedx.org/schema/bom-1.6.xsd"
- version="8"
+ version="9"
serialNumber="urn:uuid:dfa35519-9734-4259-bba1-3e825cf4be06">
<metadata>
- <timestamp>2026-07-10T20:53:31Z</timestamp>
+ <timestamp>2026-10-06T19:33:32Z</timestamp>
<manufacturer>
<name>Apache Logging Services</name>
<url>https://logging.apache.org</url>
@@ -95,6 +95,312 @@
<vulnerabilities>
+ <vulnerability>
+ <id>CVE-2026-105244</id>
+ <source>
+ <name>NVD</name>
+ <url>https://nvd.nist.gov/vuln/detail/CVE-2026-105244</url>
+ </source>
+ <ratings>
+ <rating>
+ <source>
+ <name>The Apache Software Foundation</name>
+ <url>
+ <![CDATA[https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N&version=3.1]]></url>
+ </source>
+ <score>5.3</score>
+ <severity>medium</severity>
+ <method>CVSSv3</method>
+ <vector>AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N</vector>
+ </rating>
+ </ratings>
+ <cwes>
+ <cwe>116</cwe>
+ </cwes>
+ <description><![CDATA[Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.
+
+Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.
+
+This issue affects Apache log4net: from 1.2.12 before 3.5.0.]]></description>
+ <recommendation><![CDATA[Users are advised to upgrade to Apache Log4net version `3.5.0`, which fixes this issue.]]></recommendation>
+ <created>2026-10-06T19:33:32Z</created>
+ <published>2026-10-06T19:33:32Z</published>
+ <updated>2026-10-06T19:33:32Z</updated>
+ <credits>
+ <organizations>
+ <organization>
+ <name>The Apache Software Foundation</name>
+ <url>https://www.apache.org/</url>
+ </organization>
+ </organizations>
+ </credits>
+ <affects>
+ <target>
+ <ref>log4net</ref>
+ <versions>
+ <version>
+ <range><![CDATA[vers:nuget/>=1.2.12|<3.5.0]]></range>
+ </version>
+ </versions>
+ </target>
+ </affects>
+ </vulnerability>
+
+ <vulnerability>
+ <id>CVE-2026-105243</id>
+ <source>
+ <name>NVD</name>
+ <url>https://nvd.nist.gov/vuln/detail/CVE-2026-105243</url>
+ </source>
+ <ratings>
+ <rating>
+ <source>
+ <name>The Apache Software Foundation</name>
+ <url>
+ <![CDATA[https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N&version=3.1]]></url>
+ </source>
+ <score>5.3</score>
+ <severity>medium</severity>
+ <method>CVSSv3</method>
+ <vector>AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N</vector>
+ </rating>
+ </ratings>
+ <cwes>
+ <cwe>778</cwe>
+ </cwes>
+ <description><![CDATA[Insufficient Logging vulnerability in the EventLogAppender of Apache log4net.
+
+Long messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough. Only applications on Windows that use EventLogAppender are affected.
+
+This issue affects Apache log4net: from 1.2.9 before 3.5.0.]]></description>
+ <recommendation><![CDATA[Users are advised to upgrade to Apache Log4net version `3.5.0`, which fixes this issue.]]></recommendation>
+ <created>2026-10-06T19:33:32Z</created>
+ <published>2026-10-06T19:33:32Z</published>
+ <updated>2026-10-06T19:33:32Z</updated>
+ <credits>
+ <organizations>
+ <organization>
+ <name>The Apache Software Foundation</name>
+ <url>https://www.apache.org/</url>
+ </organization>
+ </organizations>
+ </credits>
+ <affects>
+ <target>
+ <ref>log4net</ref>
+ <versions>
+ <version>
+ <range><![CDATA[vers:nuget/>=1.2.9|<3.5.0]]></range>
+ </version>
+ </versions>
+ </target>
+ </affects>
+ </vulnerability>
+
+ <vulnerability>
+ <id>CVE-2026-105242</id>
+ <source>
+ <name>NVD</name>
+ <url>https://nvd.nist.gov/vuln/detail/CVE-2026-105242</url>
+ </source>
+ <ratings>
+ <rating>
+ <source>
+ <name>The Apache Software Foundation</name>
+ <url>
+ <![CDATA[https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N&version=3.1]]></url>
+ </source>
+ <score>5.3</score>
+ <severity>medium</severity>
+ <method>CVSSv3</method>
+ <vector>AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N</vector>
+ </rating>
+ </ratings>
+ <cwes>
+ <cwe>755</cwe>
+ </cwes>
+ <description><![CDATA[Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net.
+
+Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request. Only applications on ASP.NET for .NET Framework whose layout uses %aspnet-request are affected.
+
+This issue affects Apache log4net: from 1.2.11 before 3.5.0.]]></description>
+ <recommendation><![CDATA[Users are advised to upgrade to Apache Log4net version `3.5.0`, which fixes this issue.]]></recommendation>
+ <created>2026-10-06T19:33:32Z</created>
+ <published>2026-10-06T19:33:32Z</published>
+ <updated>2026-10-06T19:33:32Z</updated>
+ <credits>
+ <organizations>
+ <organization>
+ <name>The Apache Software Foundation</name>
+ <url>https://www.apache.org/</url>
+ </organization>
+ </organizations>
+ </credits>
+ <affects>
+ <target>
+ <ref>log4net</ref>
+ <versions>
+ <version>
+ <range><![CDATA[vers:nuget/>=1.2.11|<3.5.0]]></range>
+ </version>
+ </versions>
+ </target>
+ </affects>
+ </vulnerability>
+
+ <vulnerability>
+ <id>CVE-2026-105241</id>
+ <source>
+ <name>NVD</name>
+ <url>https://nvd.nist.gov/vuln/detail/CVE-2026-105241</url>
+ </source>
+ <ratings>
+ <rating>
+ <source>
+ <name>The Apache Software Foundation</name>
+ <url>
+ <![CDATA[https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N&version=3.1]]></url>
+ </source>
+ <score>5.3</score>
+ <severity>medium</severity>
+ <method>CVSSv3</method>
+ <vector>AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N</vector>
+ </rating>
+ </ratings>
+ <cwes>
+ <cwe>176</cwe>
+ </cwes>
+ <description><![CDATA[Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net.
+
+Content that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail could be left in the pickup directory. A party whose data reaches a log message could suppress the records of other events. Only applications that use SmtpPickupDirAppender are affected.
+
+This issue affects Apache log4net: from 1.2.9 before 3.5.0.]]></description>
+ <recommendation><![CDATA[Users are advised to upgrade to Apache Log4net version `3.5.0`, which fixes this issue.]]></recommendation>
+ <created>2026-10-06T19:33:32Z</created>
+ <published>2026-10-06T19:33:32Z</published>
+ <updated>2026-10-06T19:33:32Z</updated>
+ <credits>
+ <organizations>
+ <organization>
+ <name>The Apache Software Foundation</name>
+ <url>https://www.apache.org/</url>
+ </organization>
+ </organizations>
+ </credits>
+ <affects>
+ <target>
+ <ref>log4net</ref>
+ <versions>
+ <version>
+ <range><![CDATA[vers:nuget/>=1.2.9|<3.5.0]]></range>
+ </version>
+ </versions>
+ </target>
+ </affects>
+ </vulnerability>
+
+ <vulnerability>
+ <id>CVE-2026-105240</id>
+ <source>
+ <name>NVD</name>
+ <url>https://nvd.nist.gov/vuln/detail/CVE-2026-105240</url>
+ </source>
+ <ratings>
+ <rating>
+ <source>
+ <name>The Apache Software Foundation</name>
+ <url>
+ <![CDATA[https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N&version=3.1]]></url>
+ </source>
+ <score>5.3</score>
+ <severity>medium</severity>
+ <method>CVSSv3</method>
+ <vector>AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N</vector>
+ </rating>
+ </ratings>
+ <cwes>
+ <cwe>158</cwe>
+ </cwes>
+ <description><![CDATA[Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net.
+
+A NUL character in logged content ended the debug output record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently lost. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use OutputDebugStringAppender are affected.
+
+This issue affects Apache log4net: from 1.2.9 before 3.5.0.]]></description>
+ <recommendation><![CDATA[Users are advised to upgrade to Apache Log4net version `3.5.0`, which fixes this issue.]]></recommendation>
+ <created>2026-10-06T19:33:32Z</created>
+ <published>2026-10-06T19:33:32Z</published>
+ <updated>2026-10-06T19:33:32Z</updated>
+ <credits>
+ <organizations>
+ <organization>
+ <name>The Apache Software Foundation</name>
+ <url>https://www.apache.org/</url>
+ </organization>
+ </organizations>
+ </credits>
+ <affects>
+ <target>
+ <ref>log4net</ref>
+ <versions>
+ <version>
+ <range><![CDATA[vers:nuget/>=1.2.9|<3.5.0]]></range>
+ </version>
+ </versions>
+ </target>
+ </affects>
+ </vulnerability>
+
+ <vulnerability>
+ <id>CVE-2026-105239</id>
+ <source>
+ <name>NVD</name>
+ <url>https://nvd.nist.gov/vuln/detail/CVE-2026-105239</url>
+ </source>
+ <ratings>
+ <rating>
+ <source>
+ <name>The Apache Software Foundation</name>
+ <url>
+ <![CDATA[https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N&version=3.1]]></url>
+ </source>
+ <score>5.3</score>
+ <severity>medium</severity>
+ <method>CVSSv3</method>
+ <vector>AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N</vector>
+ </rating>
+ </ratings>
+ <cwes>
+ <cwe>158</cwe>
+ </cwes>
+ <description><![CDATA[Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net.
+
+A NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently not stored. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use EventLogAppender are affected.
+
+This issue affects Apache log4net: from 1.2.9 before 3.5.0.]]></description>
+ <recommendation><![CDATA[Users are advised to upgrade to Apache Log4net version `3.5.0`, which fixes this issue.]]></recommendation>
+ <created>2026-10-06T19:33:32Z</created>
+ <published>2026-10-06T19:33:32Z</published>
+ <updated>2026-10-06T19:33:32Z</updated>
+ <credits>
+ <organizations>
+ <organization>
+ <name>The Apache Software Foundation</name>
+ <url>https://www.apache.org/</url>
+ </organization>
+ </organizations>
+ </credits>
+ <affects>
+ <target>
+ <ref>log4net</ref>
+ <versions>
+ <version>
+ <range><![CDATA[vers:nuget/>=1.2.9|<3.5.0]]></range>
+ </version>
+ </versions>
+ </target>
+ </affects>
+ </vulnerability>
+
<vulnerability>
<id>CVE-2026-49844</id>
<source>
diff --git a/download.html b/download.html
index 5a00c50d..6c5932fe 100644
--- a/download.html
+++ b/download.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Download :: Apache Logging Services</title>
<link rel="canonical" href="https://logging.apache.org/download.html">
- <meta name="generator" content="Antora 3.2.0">
+ <meta name="generator" content="Antora 3.2.1">
<link rel="stylesheet" href="./_/css/site.css">
<link rel="icon" href="./_/../_images/favicon.ico" type="image/x-icon">
<!-- `@asciidoctor/tabs` extension styles -->
diff --git a/guidelines.html b/guidelines.html
index af4a96ca..007b056f 100644
--- a/guidelines.html
+++ b/guidelines.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Guidelines :: Apache Logging Services</title>
<link rel="canonical" href="https://logging.apache.org/guidelines.html">
- <meta name="generator" content="Antora 3.2.0">
+ <meta name="generator" content="Antora 3.2.1">
<link rel="stylesheet" href="./_/css/site.css">
<link rel="icon" href="./_/../_images/favicon.ico" type="image/x-icon">
<!-- `@asciidoctor/tabs` extension styles -->
diff --git a/index.html b/index.html
index 6ddcc243..d4125a92 100644
--- a/index.html
+++ b/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Apache Logging Services :: Apache Logging Services</title>
<link rel="canonical" href="https://logging.apache.org/index.html">
- <meta name="generator" content="Antora 3.2.0">
+ <meta name="generator" content="Antora 3.2.1">
<link rel="stylesheet" href="./_/css/site.css">
<link rel="icon" href="./_/../_images/favicon.ico" type="image/x-icon">
<!-- `@asciidoctor/tabs` extension styles -->
diff --git a/processes.html b/processes.html
index e3135adc..cd61d582 100644
--- a/processes.html
+++ b/processes.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Processes :: Apache Logging Services</title>
<link rel="canonical" href="https://logging.apache.org/processes.html">
- <meta name="generator" content="Antora 3.2.0">
+ <meta name="generator" content="Antora 3.2.1">
<link rel="stylesheet" href="./_/css/site.css">
<link rel="icon" href="./_/../_images/favicon.ico" type="image/x-icon">
<!-- `@asciidoctor/tabs` extension styles -->
diff --git a/security.html b/security.html
index 53274de7..0abff00c 100644
--- a/security.html
+++ b/security.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Security :: Apache Logging Services</title>
<link rel="canonical" href="https://logging.apache.org/security.html">
- <meta name="generator" content="Antora 3.2.0">
+ <meta name="generator" content="Antora 3.2.1">
<link rel="stylesheet" href="./_/css/site.css">
<link rel="icon" href="./_/../_images/favicon.ico" type="image/x-icon">
<!-- `@asciidoctor/tabs` extension styles -->
@@ -811,6 +811,414 @@ We choose to pool all information on this one page, allowing easy searching for
</table>
</div>
<div class="sect2">
+<h3 id="CVE-2026-105244"><a class="anchor" href="#CVE-2026-105244"></a><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-105244">CVE-2026-105244</a></h3>
+<table class="tableblock frame-all grid-all stretch">
+<colgroup>
+<col style="width: 16.6666%;">
+<col style="width: 83.3334%;">
+</colgroup>
+<tbody>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">Summary</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock">RemoteSyslogAppender silently deletes non-ASCII content</p></td>
+</tr>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">CVSS 3.x Score & Vector</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock">5.3 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)</p></td>
+</tr>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">Components affected</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Log4net</p></td>
+</tr>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">Versions affected</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock"><code>[1.2.12, 3.5.0)</code></p></td>
+</tr>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">Versions fixed</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock"><code>3.5.0</code></p></td>
+</tr>
+</tbody>
+</table>
+<div class="sect3">
+<h4 id="CVE-2026-105244-description"><a class="anchor" href="#CVE-2026-105244-description"></a>Description</h4>
+<div class="paragraph">
+<p>Improper Encoding or Escaping of Output vulnerability in the RemoteSyslogAppender of Apache log4net.</p>
+</div>
+<div class="paragraph">
+<p>Every character outside visible ASCII and space was removed from the record instead of being escaped, so non-ASCII text and control characters such as tabs disappeared without notice. A party whose data reaches a log message could make a distinct value look identical in the record, for example a user name holding a zero-width space logged as admin. Only applications that use RemoteSyslogAppender are affected.</p>
+</div>
+<div class="paragraph">
+<p>This issue affects Apache log4net: from 1.2.12 before 3.5.0.</p>
+</div>
+</div>
+<div class="sect3">
+<h4 id="CVE-2026-105244-remediation"><a class="anchor" href="#CVE-2026-105244-remediation"></a>Remediation</h4>
+<div class="paragraph">
+<p>Users are advised to upgrade to Apache Log4net version <code>3.5.0</code>, which fixes this issue.</p>
+</div>
+</div>
+<div class="sect3">
+<h4 id="CVE-2026-105244-credits"><a class="anchor" href="#CVE-2026-105244-credits"></a>Credits</h4>
+<div class="paragraph">
+<p>This issue was found by The Apache Software Foundation using Claude Security.</p>
+</div>
+</div>
+<div class="sect3">
+<h4 id="CVE-2026-105244-references"><a class="anchor" href="#CVE-2026-105244-references"></a>References</h4>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-105244">CVE-2026-105244</a></p>
+</li>
+<li>
+<p><a href="https://github.com/apache/logging-log4net/pull/315">Pull request that fixes the issue</a></p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+<div class="sect2">
+<h3 id="CVE-2026-105243"><a class="anchor" href="#CVE-2026-105243"></a><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-105243">CVE-2026-105243</a></h3>
+<table class="tableblock frame-all grid-all stretch">
+<colgroup>
+<col style="width: 16.6666%;">
+<col style="width: 83.3334%;">
+</colgroup>
+<tbody>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">Summary</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Oversize EventLogAppender record silently discarded</p></td>
+</tr>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">CVSS 3.x Score & Vector</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock">5.3 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)</p></td>
+</tr>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">Components affected</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Log4net</p></td>
+</tr>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">Versions affected</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock"><code>[1.2.9, 3.5.0)</code></p></td>
+</tr>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">Versions fixed</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock"><code>3.5.0</code></p></td>
+</tr>
+</tbody>
+</table>
+<div class="sect3">
+<h4 id="CVE-2026-105243-description"><a class="anchor" href="#CVE-2026-105243-description"></a>Description</h4>
+<div class="paragraph">
+<p>Insufficient Logging vulnerability in the EventLogAppender of Apache log4net.</p>
+</div>
+<div class="paragraph">
+<p>Long messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data reaches a log message could suppress the whole record by making it long enough. Only applications on Windows that use EventLogAppender are affected.</p>
+</div>
+<div class="paragraph">
+<p>This issue affects Apache log4net: from 1.2.9 before 3.5.0.</p>
+</div>
+</div>
+<div class="sect3">
+<h4 id="CVE-2026-105243-remediation"><a class="anchor" href="#CVE-2026-105243-remediation"></a>Remediation</h4>
+<div class="paragraph">
+<p>Users are advised to upgrade to Apache Log4net version <code>3.5.0</code>, which fixes this issue.</p>
+</div>
+</div>
+<div class="sect3">
+<h4 id="CVE-2026-105243-credits"><a class="anchor" href="#CVE-2026-105243-credits"></a>Credits</h4>
+<div class="paragraph">
+<p>This issue was found by The Apache Software Foundation using Claude Security.</p>
+</div>
+</div>
+<div class="sect3">
+<h4 id="CVE-2026-105243-references"><a class="anchor" href="#CVE-2026-105243-references"></a>References</h4>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-105243">CVE-2026-105243</a></p>
+</li>
+<li>
+<p><a href="https://github.com/apache/logging-log4net/pull/315">Pull request that fixes the issue</a></p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+<div class="sect2">
+<h3 id="CVE-2026-105242"><a class="anchor" href="#CVE-2026-105242"></a><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-105242">CVE-2026-105242</a></h3>
+<table class="tableblock frame-all grid-all stretch">
+<colgroup>
+<col style="width: 16.6666%;">
+<col style="width: 83.3334%;">
+</colgroup>
+<tbody>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">Summary</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Request validation failure drops the event in the aspnet-request converter</p></td>
+</tr>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">CVSS 3.x Score & Vector</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock">5.3 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)</p></td>
+</tr>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">Components affected</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Log4net</p></td>
+</tr>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">Versions affected</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock"><code>[1.2.11, 3.5.0)</code></p></td>
+</tr>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">Versions fixed</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock"><code>3.5.0</code></p></td>
+</tr>
+</tbody>
+</table>
+<div class="sect3">
+<h4 id="CVE-2026-105242-description"><a class="anchor" href="#CVE-2026-105242-description"></a>Description</h4>
+<div class="paragraph">
+<p>Improper Handling of Exceptional Conditions vulnerability in the aspnet-request pattern converter of Apache log4net.</p>
+</div>
+<div class="paragraph">
+<p>Reading request parameters triggers ASP.NET request validation, so a request carrying content such as markup made the layout throw and the appender discarded the whole event. A sender could suppress the log record of their own request. Only applications on ASP.NET for .NET Framework whose layout uses %aspnet-request are affected.</p>
+</div>
+<div class="paragraph">
+<p>This issue affects Apache log4net: from 1.2.11 before 3.5.0.</p>
+</div>
+</div>
+<div class="sect3">
+<h4 id="CVE-2026-105242-remediation"><a class="anchor" href="#CVE-2026-105242-remediation"></a>Remediation</h4>
+<div class="paragraph">
+<p>Users are advised to upgrade to Apache Log4net version <code>3.5.0</code>, which fixes this issue.</p>
+</div>
+</div>
+<div class="sect3">
+<h4 id="CVE-2026-105242-credits"><a class="anchor" href="#CVE-2026-105242-credits"></a>Credits</h4>
+<div class="paragraph">
+<p>This issue was found by The Apache Software Foundation using Claude Security.</p>
+</div>
+</div>
+<div class="sect3">
+<h4 id="CVE-2026-105242-references"><a class="anchor" href="#CVE-2026-105242-references"></a>References</h4>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-105242">CVE-2026-105242</a></p>
+</li>
+<li>
+<p><a href="https://github.com/apache/logging-log4net/pull/316">Pull request that fixes the issue</a></p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+<div class="sect2">
+<h3 id="CVE-2026-105241"><a class="anchor" href="#CVE-2026-105241"></a><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-105241">CVE-2026-105241</a></h3>
+<table class="tableblock frame-all grid-all stretch">
+<colgroup>
+<col style="width: 16.6666%;">
+<col style="width: 83.3334%;">
+</colgroup>
+<tbody>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">Summary</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Unencodable content discards a whole SmtpPickupDirAppender batch</p></td>
+</tr>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">CVSS 3.x Score & Vector</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock">5.3 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)</p></td>
+</tr>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">Components affected</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Log4net</p></td>
+</tr>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">Versions affected</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock"><code>[1.2.9, 3.5.0)</code></p></td>
+</tr>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">Versions fixed</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock"><code>3.5.0</code></p></td>
+</tr>
+</tbody>
+</table>
+<div class="sect3">
+<h4 id="CVE-2026-105241-description"><a class="anchor" href="#CVE-2026-105241-description"></a>Description</h4>
+<div class="paragraph">
+<p>Improper Handling of Unicode Encoding vulnerability in the SmtpPickupDirAppender of Apache log4net.</p>
+</div>
+<div class="paragraph">
+<p>Content that the mail file writer cannot encode, such as an unpaired UTF-16 surrogate, made the write throw. Every buffered event in the batch was discarded, not only the one carrying the content, and a truncated mail could be left in the pickup directory. A party whose data reaches a log message could suppress the records of other events. Only applications that use SmtpPickupDirAppender are affected.</p>
+</div>
+<div class="paragraph">
+<p>This issue affects Apache log4net: from 1.2.9 before 3.5.0.</p>
+</div>
+</div>
+<div class="sect3">
+<h4 id="CVE-2026-105241-remediation"><a class="anchor" href="#CVE-2026-105241-remediation"></a>Remediation</h4>
+<div class="paragraph">
+<p>Users are advised to upgrade to Apache Log4net version <code>3.5.0</code>, which fixes this issue.</p>
+</div>
+</div>
+<div class="sect3">
+<h4 id="CVE-2026-105241-credits"><a class="anchor" href="#CVE-2026-105241-credits"></a>Credits</h4>
+<div class="paragraph">
+<p>This issue was found by The Apache Software Foundation using Claude Security.</p>
+</div>
+</div>
+<div class="sect3">
+<h4 id="CVE-2026-105241-references"><a class="anchor" href="#CVE-2026-105241-references"></a>References</h4>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-105241">CVE-2026-105241</a></p>
+</li>
+<li>
+<p><a href="https://github.com/apache/logging-log4net/pull/315">Pull request that fixes the issue</a></p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+<div class="sect2">
+<h3 id="CVE-2026-105240"><a class="anchor" href="#CVE-2026-105240"></a><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-105240">CVE-2026-105240</a></h3>
+<table class="tableblock frame-all grid-all stretch">
+<colgroup>
+<col style="width: 16.6666%;">
+<col style="width: 83.3334%;">
+</colgroup>
+<tbody>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">Summary</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock">NUL character truncates OutputDebugStringAppender records</p></td>
+</tr>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">CVSS 3.x Score & Vector</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock">5.3 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)</p></td>
+</tr>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">Components affected</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Log4net</p></td>
+</tr>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">Versions affected</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock"><code>[1.2.9, 3.5.0)</code></p></td>
+</tr>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">Versions fixed</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock"><code>3.5.0</code></p></td>
+</tr>
+</tbody>
+</table>
+<div class="sect3">
+<h4 id="CVE-2026-105240-description"><a class="anchor" href="#CVE-2026-105240-description"></a>Description</h4>
+<div class="paragraph">
+<p>Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net.</p>
+</div>
+<div class="paragraph">
+<p>A NUL character in logged content ended the debug output record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently lost. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use OutputDebugStringAppender are affected.</p>
+</div>
+<div class="paragraph">
+<p>This issue affects Apache log4net: from 1.2.9 before 3.5.0.</p>
+</div>
+</div>
+<div class="sect3">
+<h4 id="CVE-2026-105240-remediation"><a class="anchor" href="#CVE-2026-105240-remediation"></a>Remediation</h4>
+<div class="paragraph">
+<p>Users are advised to upgrade to Apache Log4net version <code>3.5.0</code>, which fixes this issue.</p>
+</div>
+</div>
+<div class="sect3">
+<h4 id="CVE-2026-105240-credits"><a class="anchor" href="#CVE-2026-105240-credits"></a>Credits</h4>
+<div class="paragraph">
+<p>This issue was found by The Apache Software Foundation using Claude Security.</p>
+</div>
+</div>
+<div class="sect3">
+<h4 id="CVE-2026-105240-references"><a class="anchor" href="#CVE-2026-105240-references"></a>References</h4>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-105240">CVE-2026-105240</a></p>
+</li>
+<li>
+<p><a href="https://github.com/apache/logging-log4net/pull/315">Pull request that fixes the issue</a></p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+<div class="sect2">
+<h3 id="CVE-2026-105239"><a class="anchor" href="#CVE-2026-105239"></a><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-105239">CVE-2026-105239</a></h3>
+<table class="tableblock frame-all grid-all stretch">
+<colgroup>
+<col style="width: 16.6666%;">
+<col style="width: 83.3334%;">
+</colgroup>
+<tbody>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">Summary</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock">NUL character truncates EventLogAppender records</p></td>
+</tr>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">CVSS 3.x Score & Vector</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock">5.3 MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)</p></td>
+</tr>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">Components affected</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock">Log4net</p></td>
+</tr>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">Versions affected</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock"><code>[1.2.9, 3.5.0)</code></p></td>
+</tr>
+<tr>
+<th class="tableblock halign-left valign-top"><p class="tableblock">Versions fixed</p></th>
+<td class="tableblock halign-left valign-top"><p class="tableblock"><code>3.5.0</code></p></td>
+</tr>
+</tbody>
+</table>
+<div class="sect3">
+<h4 id="CVE-2026-105239-description"><a class="anchor" href="#CVE-2026-105239-description"></a>Description</h4>
+<div class="paragraph">
+<p>Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net.</p>
+</div>
+<div class="paragraph">
+<p>A NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently not stored. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use EventLogAppender are affected.</p>
+</div>
+<div class="paragraph">
+<p>This issue affects Apache log4net: from 1.2.9 before 3.5.0.</p>
+</div>
+</div>
+<div class="sect3">
+<h4 id="CVE-2026-105239-remediation"><a class="anchor" href="#CVE-2026-105239-remediation"></a>Remediation</h4>
+<div class="paragraph">
+<p>Users are advised to upgrade to Apache Log4net version <code>3.5.0</code>, which fixes this issue.</p>
+</div>
+</div>
+<div class="sect3">
+<h4 id="CVE-2026-105239-credits"><a class="anchor" href="#CVE-2026-105239-credits"></a>Credits</h4>
+<div class="paragraph">
+<p>This issue was found by The Apache Software Foundation using Claude Security.</p>
+</div>
+</div>
+<div class="sect3">
+<h4 id="CVE-2026-105239-references"><a class="anchor" href="#CVE-2026-105239-references"></a>References</h4>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-105239">CVE-2026-105239</a></p>
+</li>
+<li>
+<p><a href="https://github.com/apache/logging-log4net/pull/315">Pull request that fixes the issue</a></p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+<div class="sect2">
<h3 id="CVE-2026-49844"><a class="anchor" href="#CVE-2026-49844"></a><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-49844">CVE-2026-49844</a></h3>
<table class="tableblock frame-all grid-all stretch">
<colgroup>
diff --git a/security/faq.html b/security/faq.html
index b5c4e864..82734ffd 100644
--- a/security/faq.html
+++ b/security/faq.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Frequently Reported Vulnerabilities :: Apache Logging Services</title>
<link rel="canonical" href="https://logging.apache.org/security/faq.html">
- <meta name="generator" content="Antora 3.2.0">
+ <meta name="generator" content="Antora 3.2.1">
<link rel="stylesheet" href="../_/css/site.css">
<link rel="icon" href="../_/../_images/favicon.ico" type="image/x-icon">
<!-- `@asciidoctor/tabs` extension styles -->
diff --git a/sitemap.xml b/sitemap.xml
index 072548b5..ac97d03e 100644
--- a/sitemap.xml
+++ b/sitemap.xml
@@ -2,86 +2,86 @@
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
<url>
<loc>https://logging.apache.org/blog/20231117-flume-joins-logging-services.html</loc>
-<lastmod>2026-09-17T19:33:35.882Z</lastmod>
+<lastmod>2026-10-06T19:57:45.312Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/20231128-new-pmc-member.html</loc>
-<lastmod>2026-09-17T19:33:35.882Z</lastmod>
+<lastmod>2026-10-06T19:57:45.312Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/20231202-apache-common-logging-1.3.0.html</loc>
-<lastmod>2026-09-17T19:33:35.882Z</lastmod>
+<lastmod>2026-10-06T19:57:45.312Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/20231214-announcing-support-from-the-stf.html</loc>
-<lastmod>2026-09-17T19:33:35.882Z</lastmod>
+<lastmod>2026-10-06T19:57:45.312Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/20231218-20-years-of-innovation.html</loc>
-<lastmod>2026-09-17T19:33:35.882Z</lastmod>
+<lastmod>2026-10-06T19:57:45.312Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/20240725-Log4j-At-Community-Over-Code-2024.html</loc>
-<lastmod>2026-09-17T19:33:35.882Z</lastmod>
+<lastmod>2026-10-06T19:57:45.312Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/20240808-welcome-to-the-pmc-jan.html</loc>
-<lastmod>2026-09-17T19:33:35.882Z</lastmod>
+<lastmod>2026-10-06T19:57:45.312Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/20240812-log4j-bug-bounty.html</loc>
-<lastmod>2026-09-17T19:33:35.882Z</lastmod>
+<lastmod>2026-10-06T19:57:45.312Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/20250728-introduction-to-vex-files.html</loc>
-<lastmod>2026-09-17T19:33:35.882Z</lastmod>
+<lastmod>2026-10-06T19:57:45.312Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/blog/index.html</loc>
-<lastmod>2026-09-17T19:33:35.882Z</lastmod>
+<lastmod>2026-10-06T19:57:45.312Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/charter.html</loc>
-<lastmod>2026-09-17T19:33:35.882Z</lastmod>
+<lastmod>2026-10-06T19:57:45.312Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/download.html</loc>
-<lastmod>2026-09-17T19:33:35.882Z</lastmod>
+<lastmod>2026-10-06T19:57:45.312Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/guidelines.html</loc>
-<lastmod>2026-09-17T19:33:35.882Z</lastmod>
+<lastmod>2026-10-06T19:57:45.312Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/index.html</loc>
-<lastmod>2026-09-17T19:33:35.882Z</lastmod>
+<lastmod>2026-10-06T19:57:45.312Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/processes.html</loc>
-<lastmod>2026-09-17T19:33:35.882Z</lastmod>
+<lastmod>2026-10-06T19:57:45.312Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/security.html</loc>
-<lastmod>2026-09-17T19:33:35.882Z</lastmod>
+<lastmod>2026-10-06T19:57:45.312Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/security/faq.html</loc>
-<lastmod>2026-09-17T19:33:35.882Z</lastmod>
+<lastmod>2026-10-06T19:57:45.312Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/support.html</loc>
-<lastmod>2026-09-17T19:33:35.882Z</lastmod>
+<lastmod>2026-10-06T19:57:45.312Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/team-list.html</loc>
-<lastmod>2026-09-17T19:33:35.882Z</lastmod>
+<lastmod>2026-10-06T19:57:45.312Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/what-is-logging.html</loc>
-<lastmod>2026-09-17T19:33:35.882Z</lastmod>
+<lastmod>2026-10-06T19:57:45.312Z</lastmod>
</url>
<url>
<loc>https://logging.apache.org/xml/ns/index.html</loc>
-<lastmod>2026-09-17T19:33:35.882Z</lastmod>
+<lastmod>2026-10-06T19:57:45.312Z</lastmod>
</url>
</urlset>
diff --git a/support.html b/support.html
index 0e2d3752..6d456ae9 100644
--- a/support.html
+++ b/support.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Support :: Apache Logging Services</title>
<link rel="canonical" href="https://logging.apache.org/support.html">
- <meta name="generator" content="Antora 3.2.0">
+ <meta name="generator" content="Antora 3.2.1">
<link rel="stylesheet" href="./_/css/site.css">
<link rel="icon" href="./_/../_images/favicon.ico" type="image/x-icon">
<!-- `@asciidoctor/tabs` extension styles -->
diff --git a/team-list.html b/team-list.html
index 5bb5d19a..79f48f1e 100644
--- a/team-list.html
+++ b/team-list.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Team :: Apache Logging Services</title>
<link rel="canonical" href="https://logging.apache.org/team-list.html">
- <meta name="generator" content="Antora 3.2.0">
+ <meta name="generator" content="Antora 3.2.1">
<link rel="stylesheet" href="./_/css/site.css">
<link rel="icon" href="./_/../_images/favicon.ico" type="image/x-icon">
<!-- `@asciidoctor/tabs` extension styles -->
diff --git a/what-is-logging.html b/what-is-logging.html
index 3c087951..ffc13fac 100644
--- a/what-is-logging.html
+++ b/what-is-logging.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>What is logging? :: Apache Logging Services</title>
<link rel="canonical" href="https://logging.apache.org/what-is-logging.html">
- <meta name="generator" content="Antora 3.2.0">
+ <meta name="generator" content="Antora 3.2.1">
<link rel="stylesheet" href="./_/css/site.css">
<link rel="icon" href="./_/../_images/favicon.ico" type="image/x-icon">
<!-- `@asciidoctor/tabs` extension styles -->
diff --git a/xml/ns/index.html b/xml/ns/index.html
index 707faeb5..2ac13bc0 100644
--- a/xml/ns/index.html
+++ b/xml/ns/index.html
@@ -5,7 +5,7 @@
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>XML Schemas for Apache Logging Services projects :: Apache Logging Services</title>
<link rel="canonical" href="https://logging.apache.org/xml/ns/index.html">
- <meta name="generator" content="Antora 3.2.0">
+ <meta name="generator" content="Antora 3.2.1">
<link rel="stylesheet" href="../../_/css/site.css">
<link rel="icon" href="../../_/../_images/favicon.ico" type="image/x-icon">
<!-- `@asciidoctor/tabs` extension styles -->