CVE-2026-105239: apache software foundation apache log4net
Vulnerability summary
CVE-2026-105239 is a medium (CVSS 5.3) vulnerability in apache software foundation apache log4net. EPSS estimates a 0.82% chance of exploitation in the next 30 days, higher than 56.5% of scored vulnerabilities.
Timeline
- 06-10-2026PublishedVulnerability first disclosed.
- 07-10-2026Last modifiedVulnerability information updated.
Description
Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net. A NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently not stored. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use EventLogAppender are affected. This issue affects Apache log4net: from 1.2.9 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- NVDNIST5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.82%
Chance of exploitation in the next 30 days
Percentile
57%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Apache1 product
- log4net≥ 1.2.9, < 3.5.0
Apache software foundation1 product
- apache log4net≥ 1.2.9, < 3.5.0 | ≥ 02e1e115435888485f2e28b414d267e39e799e07, < dc5855a0720c91590fd7a81d729ea01fdd69e000
Debian1 product
- log4netAll versions (No fix recorded)
Ubuntu1 product
- log4netAll versions (No fix recorded)
4 vendors · 4 products
