CVE-2026-105239: Apache log4net: NUL character truncates EventLogAppender records
Apache log4net CVE-2026-105239 lets a NUL byte truncate Windows Event Log records written by EventLogAppender.
34
Vulnerability2 · 1 read
CVE-2026-105239
NUL byte truncates Apache log4net Event Log records
- CVSS 3.1
- 5.3 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache log4net before 3.5.0 fails to neutralize NUL bytes in the EventLogAppender. If logged content contains a NUL character, Windows ends the Event Log record at that point, so everything the layout would have written afterward—including exception text and trailing fields—is silently dropped. Anyone who can place data into a log message can hide the rest of that record and weaken audit or incident evidence. Only applications running on Windows that use EventLogAppender with log4net 1.2.9 through versions before 3.5.0 are affected. There is no known public proof of concept and no indication of exploitation in the wild.
What to do: Upgrade Apache log4net to 3.5.0. Until then, do not send untrusted data through EventLogAppender, or strip NUL bytes from content before it is logged, and review existing Windows Event Log records from affected apps for entries that end abruptly and may be missing exception text or trailing fields.
| Product | Affected |
|---|---|
| Apache log4net | 1.2.9 before 3.5.0 |
Estimated exposure
largeOn the order of 100,000–1,000,000 Windows .NET applications that use EventLogAppender — log4net is a long-standing, very widely downloaded .NET logging library used across many Windows applications, but only processes that actually use EventLogAppender are affected, so the exposed set is a substantial subset of total installs…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net. A NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently not stored. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use EventLogAppender are affected. This issue affects Apache log4net: from 1.2.9 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.