Vulnerabilitymedium
CVE-2026-105239: Apache log4net: NUL character truncates EventLogAppender records
AI summary · grok-4.7Summaries by Vani AI
Apache log4net CVE-2026-105239 lets a NUL byte truncate Windows Event Log records written by EventLogAppender.
Apache disclosed CVE-2026-105239, a null-byte handling flaw in log4net's EventLogAppender. A NUL character in logged content ends the Windows Event Log record early, truncating the entry. CVSS 3.1 is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), rated moderate. Affected versions are log4net 1.2.9 before 3.5.0 and commits before dc5855a0720c91590fd7a81d729ea01fdd69e000.
Key facts
- CVE-2026-105239 is improper NUL-byte neutralization in EventLogAppender.
- A NUL in logged content truncates the Windows Event Log record.
- CVSS 3.1 is 5.3 with low integrity and no confidentiality or availability impact.
- Fixed in log4net 3.5.0 and commit dc5855a0720c91590fd7a81d729ea01fdd69e000.
- CVEs
- CVE-2026-105239
- Vendors
- Apache Software Foundation
- Products
- Apache log4netEventLogAppender
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-105239 | NUL byte truncates Apache log4net Event Log records | 5.3 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | 02e1e115435888485f2e28b414d267e39e799e07 | sions: - Apache log4net 1.2.9 before 3.5.0 - Apache log4net 02e1e115435888485f2e28b414d267e39e799e07 before dc5855a0720c91590fd7a81d729ea01fdd69e000 Description |
| sha1 | dc5855a0720c91590fd7a81d729ea01fdd69e000 | che log4net 02e1e115435888485f2e28b414d267e39e799e07 before dc5855a0720c91590fd7a81d729ea01fdd69e000 Description: Improper Neutralization of Null Byte or NUL Ch |
From the original article
Posted by Jan Friedrich on Oct 06 Severity: moderate CVSS 3. 1: 5. 3 (medium) CVSS:3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.