CVE-2026-105239: CWE-158 Improper Neutralization of Null Byte or NUL Character in Apache Software Foundation Apache log4net
Description
CVE-2026-105239 is a medium severity vulnerability in Apache log4net affecting versions from 1.2.9 up to but not including 3.5.0. It involves improper neutralization of the null byte character in the EventLogAppender on Windows platforms. When a null byte is present in logged content, it prematurely terminates the Windows Event Log record, causing subsequent log data, including exception details, to be silently omitted. This allows data reaching the log message to hide parts of the log record. The issue is fixed in version 3.5.0.
CVSS v3.1
Score 5.3medium
Affected software
Apache Software Foundation
Apache log4net
Apache Software Foundation
Apache log4net
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-105239 in Apache log4net's EventLogAppender arises from improper handling of null byte (NUL) characters in logged content on Windows. The presence of a null byte truncates the Windows Event Log record at that point, resulting in loss of all subsequent log information such as exception text and trailing fields. This behavior enables an attacker or any party whose data is logged to conceal part of the log record. This affects Apache log4net versions starting from 1.2.9 up to but not including 3.5.0. The vendor has addressed this issue in version 3.5.0.
Potential Impact
The vulnerability allows partial log record truncation on Windows systems using the EventLogAppender, which can lead to incomplete logging of events. This may hinder forensic analysis or auditing by hiding important log details such as exception information. There is no direct confidentiality or availability impact reported. The integrity of logs is impacted due to the silent omission of trailing log data.
Mitigation Recommendations
Users should upgrade Apache log4net to version 3.5.0 or later, where this issue is fixed. No other mitigation or temporary workaround is indicated. Patch status is confirmed fixed in 3.5.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-10-04T16:19:29.460Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ac550db2cdf04f656d8a125
Added to database: 10/06/2026, 19:49:47 UTC
Last enriched: 10/06/2026, 20:19:34 UTC
Last updated: 10/06/2026, 20:19:34 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.