CVE-2026-105240

Name of the Vulnerable Software and Affected Versions Apache log4net versions 1.2.9 through 3.4.x

Description Improper neutralization of null bytes or NUL characters in the OutputDebugStringAppender allows logged content to be truncated. When a NUL character is present, the debug output record ends at that point, causing all subsequent rendered layout data, such as exception text and trailing fields, to be silently lost. This allows an attacker who can control data reaching a log message to hide the remainder of the record. This issue specifically affects applications running on Windows that utilize the OutputDebugStringAppender.

Recommendations Upgrade to version 3.5.0.