CVE-2026-105240: Apache log4net: NUL character truncates OutputDebugStringAppender records
Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net.
A NUL character in logged content ended the debug output record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently lost. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use OutputDebugStringAppender are affected.
This issue affects Apache log4net: from 1.2.9 before 3.5.0.
Users are recommended to upgrade to version 3.5.0, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache log4netto a version that resolves this vulnerability.Fixed in 3.5.0
Event History
Frequently Asked Questions
Which deployments are affected?
Only Windows applications that use log4net's OutputDebugStringAppender are affected. The affected log4net versions range from 1.2.9 up to, but not including, 3.5.0.
What must an attacker be able to do?
An attacker needs to supply data that reaches a logged message and includes a NUL character. That character can cause the debug output record to end early, hiding subsequently rendered content such as exception text and trailing fields.
What should teams do to remediate this issue?
Upgrade Apache log4net to version 3.5.0. This version fixes the truncation issue.
How can we assess whether our application is exposed?
Check whether the application runs on Windows, uses OutputDebugStringAppender, and has a log4net version earlier than 3.5.0 but no earlier than 1.2.9. Applications not using that appender are not affected.