CVE-2026-105239

Name of the Vulnerable Software and Affected Versions Apache log4net versions 1.2.9 through 3.4.x

Description Improper neutralization of null bytes or NUL characters in the EventLogAppender allows a NUL character in logged content to truncate the Windows Event Log record. This results in all subsequent data rendered by the layout, such as exception text and trailing fields, being silently omitted. An attacker capable of injecting data into a log message could use this to hide the remainder of the record. This issue specifically affects applications running on Windows that utilize the EventLogAppender.

Recommendations Upgrade to version 3.5.0.