CVE-2026-105240

Analyzed Analyzed - Analysis Complete

Null Byte Injection in Apache log4net OutputDebugStringAppender

Publication date: 2026-10-06

Last updated on: 2026-10-09

Assigner: Apache Software Foundation

Description

Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net. A NUL character in logged content ended the debug output record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently lost. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use OutputDebugStringAppender are affected. This issue affects Apache log4net: from 1.2.9 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-09

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105240

EUVD

EUVD-2026-93864

Affected Vendors & Products

Vendor	Product	Version / Range
apache	log4net	From 1.2.9 (inc) to 3.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-158	The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper handling of null bytes in the OutputDebugStringAppender of Apache log4net. A null character in logged content prematurely terminates the debug output, causing subsequent data like exception text to be lost silently. Attackers could exploit this to hide parts of log records.

Detection Guidance

This vulnerability affects only Windows systems using the OutputDebugStringAppender in Apache log4net versions before 3.5.0. To detect it, check the log4net version in use with commands like 'findstr /C:"log4net" /s *.*' in directories where log4net.dll is located. Verify if the version is below 3.5.0.

Impact Analysis

If you use Apache log4net on Windows with OutputDebugStringAppender, an attacker could manipulate log data to omit critical information like errors or security events. This may lead to undetected issues, incorrect debugging, or compliance violations due to incomplete logs.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by allowing data truncation in logs. If logged data is incomplete due to the NUL character issue, it may fail to capture full records required for audit trails or data integrity checks under these regulations.

Mitigation Strategies

Upgrade Apache log4net to version 3.5.0 or later immediately. This version fixes the improper neutralization of null byte issue in OutputDebugStringAppender. No other mitigation steps are required if the upgrade is applied.

Hi! I’m here to help you understand CVE-2026-105240. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70