Improper handling of exceptional conditions in the aspnet-request converter of Apache log4net causes event data that triggers ASP.NET request validation to be dropped from the log. When a request contains markup or otherwise invalid content, the layout throws, leading the appender to discard the entire logging event. The result is that a sender can effectively suppress the audit record of their own request, weakening traceability and forensic capability for malicious activity.

Apache Software Foundation’s Apache log4net is affected. The flaw exists in versions starting at 1.2.11 through all releases before 3.5.0. Applications built on ASP.NET for the .NET Framework that employ the %aspnet-request pattern in their log layouts are vulnerable.

The CVSS score of 5.3 indicates a moderate severity. EPSS information is unavailable, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. The most likely attack vector is an attacker sending a crafted HTTP request containing markup to an ASP.NET application that uses log4net with the %aspnet-request converter, thereby causing legitimate log entries for the attacker’s activity to be omitted.