CVE-2026-105240: CWE-158 Improper Neutralization of Null Byte or NUL Character in Apache Software Foundation Apache log4net

This vulnerability in Apache log4net's OutputDebugStringAppender occurs because a null byte in logged content prematurely terminates the debug output record. As a result, any layout-rendered content after the null byte, such as exception text and trailing fields, is lost silently. This can be exploited by an attacker who can inject data containing a null byte into log messages, effectively hiding parts of the log record. The flaw affects Apache log4net versions from 1.2.9 up to but not including 3.5.0 and only impacts Windows applications using OutputDebugStringAppender. The vendor fixed this issue in version 3.5.0.

The vulnerability allows an attacker who can influence log message content to truncate log entries at a null byte, hiding subsequent log information such as exception details. This can impair forensic analysis and troubleshooting by concealing relevant log data. There is no direct impact on confidentiality or availability, but integrity of log records is affected. The vulnerability is limited to Windows environments using the OutputDebugStringAppender in affected log4net versions.

Users should upgrade Apache log4net to version 3.5.0 or later, where this issue is fixed. No other mitigations are specified. Since this is a software vulnerability with an official fix, applying the update is the recommended remediation.