CVE-2026-105240: Apache log4net: NUL character truncates OutputDebugStringAppender records
AI summary · grok-4.7Summaries by Vani AI
Apache log4net OutputDebugStringAppender stops at NUL bytes, CVE-2026-105240, CVSS 5.3.
Jan Friedrich disclosed CVE-2026-105240, improper NUL neutralization in Apache log4net's OutputDebugStringAppender. A NUL character in logged content ends the debug output record. CVSS 3.1 is 5.3, with low integrity impact and no confidentiality or availability impact. Affected versions are 1.2.9 before 3.5.0, and the post does not report exploitation.
Key facts
- A NUL byte truncates OutputDebugStringAppender debug records.
- CVSS 3.1 score is 5.3; integrity impact is low.
- Affects Apache log4net 1.2.9 before 3.5.0.
- No in-the-wild exploitation is mentioned.
- CVEs
- CVE-2026-105240
- Vendors
- Apache Software Foundation
- Products
- Apache log4net
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105240 | NUL truncation in Apache log4net OutputDebugStringAppender | 5.3 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 02e1e115435888485f2e28b414d267e39e799e07 | sions: - Apache log4net 1.2.9 before 3.5.0 - Apache log4net 02e1e115435888485f2e28b414d267e39e799e07 before 6046fe9d7f353b49fe995361c071ec2eea8f7ef6 Description |
| sha1 | 6046fe9d7f353b49fe995361c071ec2eea8f7ef6 | che log4net 02e1e115435888485f2e28b414d267e39e799e07 before 6046fe9d7f353b49fe995361c071ec2eea8f7ef6 Description: Improper Neutralization of Null Byte or NUL Ch |
From the original article
Posted by Jan Friedrich on Oct 06 Severity: moderate CVSS 3. 1: 5. 3 (medium) CVSS:3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.