CVE-2026-105240: Apache log4net: NUL character truncates OutputDebugStringAppender records
Apache log4net OutputDebugStringAppender stops at NUL bytes, CVE-2026-105240, CVSS 5.3.
28
Vulnerability2 · 1 read
CVE-2026-105240
NUL truncation in Apache log4net OutputDebugStringAppender
- CVSS 3.1
- 5.3 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Apache log4net before 3.5.0 fails to neutralize NUL bytes in OutputDebugStringAppender. On Windows, a NUL in logged content ends the debug output record at that point, so everything the layout rendered afterward—including exception text and trailing fields—is silently dropped. Anyone who can place data into a log message can hide the rest of that record and weaken audit or debug evidence. Only Windows applications that use OutputDebugStringAppender with log4net 1.2.9 through versions before 3.5.0 are affected. There is no known public proof of concept and the issue is not listed in CISA KEV.
What to do: Upgrade Apache log4net to 3.5.0. Until then, stop using OutputDebugStringAppender for messages that can contain untrusted data, or switch to an appender that does not pass records through the Windows debug API, and review existing debug output for records that end early.
| Product | Affected |
|---|---|
| Apache log4net | 1.2.9 before 3.5.0 |
Estimated exposure
largeunknown (log4net is widely deployed; only the Windows OutputDebugStringAppender subset is affected) — log4net is a long-standing, widely downloaded NuGet logging library embedded in many .NET applications, but only Windows processes configured with OutputDebugStringAppender are affected and there is no public count of that configuration.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net. A NUL character in logged content ended the debug output record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently lost. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use OutputDebugStringAppender are affected. This issue affects Apache log4net: from 1.2.9 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.