Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net. (CVE-2026-105239)

The vulnerability in Apache log4net's EventLogAppender arises because a NUL character in the logged content causes the Windows Event Log record to end at that point, preventing subsequent log data from being recorded. This behavior can be exploited by an attacker who can inject data into log messages to conceal parts of the log entry, such as exception text or trailing fields. Only Windows applications using EventLogAppender are affected. The vulnerability affects versions from 1.2.9 before 3.5.0. The vendor fixed the issue in version 3.5.0.

The vulnerability allows an attacker who can influence log messages to truncate Windows Event Log records by injecting a NUL character, effectively hiding parts of the log entry. This can impair forensic analysis and auditing by omitting critical information from logs. There is no direct confidentiality or availability impact, but integrity of log data is compromised.

Users should upgrade Apache log4net to version 3.5.0 or later, where this issue is fixed. No other mitigations are specified or required. Patch status is confirmed as fixed in version 3.5.0.