CVE-2026-105239

Analyzed Analyzed - Analysis Complete

Null Byte Injection in Apache log4net EventLogAppender

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: Apache Software Foundation

Description

Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net. A NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently not stored. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use EventLogAppender are affected. This issue affects Apache log4net: from 1.2.9 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105239

EUVD

EUVD-2026-93863

Affected Vendors & Products

Vendor	Product	Version / Range
apache	log4net	From 1.2.9 (inc) to 3.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-158	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper handling of null bytes in logged content by Apache log4net's EventLogAppender. A null character in a log message can prematurely terminate the Windows Event Log record, causing subsequent data like exception text to be omitted. This allows an attacker to hide parts of the log entry by inserting a null byte.

Detection Guidance

This vulnerability affects only Windows systems using EventLogAppender in Apache log4net versions before 3.5.0. Check your log4net version with commands like 'findstr /C:"log4net" /s /i *.dll' or inspect project dependencies. Verify if EventLogAppender is used in configuration files.

Impact Analysis

If you use Apache log4net on Windows with EventLogAppender, an attacker could manipulate log entries by inserting a null byte. This could hide malicious activity or errors in logs, making it harder to detect security incidents or troubleshoot issues. Only Windows applications using this appender are affected.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized parties to hide log data. For GDPR, it may affect data integrity and audit trails. For HIPAA, it could compromise the integrity of audit logs required for security monitoring. Proper logging is critical for compliance.

Mitigation Strategies

Upgrade Apache log4net to version 3.5.0 or later immediately. Replace or remove EventLogAppender from configurations if possible. Monitor logs for truncated entries indicating exploitation attempts.

Hi! I’m here to help you understand CVE-2026-105239. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70