# CVE-2026-105239: Apache log4net null byte injection in EventLogAppender

Source: https://junglewise.ai/threats/cve-2026-105239-improper-neutralization-of-null-byte-or-nul-character  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-105239 · Severity: medium · CVSS 5.3 · Published 2026-10-06

Apache log4net is a widely-used logging library for .NET applications. On Windows, the EventLogAppender component truncates log records when a null byte appears in the logged data, allowing an attacker to hide exception traces and other critical log information. This can obscure security incidents and complicate incident investigation.

Technologies: [Apache Log4net](https://junglewise.ai/threats/technologies/log4net). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-105239 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105239 being exploited in the wild.

**How severe is CVE-2026-105239?** Medium severity, with a CVSS score of 5.3, published 6 October 2026.

**Which products and versions are affected?** Apache Log4net 1.2.9 through 3.4.x.

**Is there a fix for CVE-2026-105239?** Yes: fixed in 3.5.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105239 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-105239?** Check whether you run Apache Log4net at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.5.0

## Technical details

The EventLogAppender on Windows passes logged content to ReportEventW, which treats null bytes as string terminators. A null byte in log data causes the Windows Event Log to store only the portion before it, dropping layout-rendered content including exceptions and trailing fields. The vulnerability affects versions 1.2.9 through 3.4.x; version 3.5.0 escapes null bytes before writing to the event log.

## Affected products

- Apache log4net 1.2.9 through 3.4.x

## Timeline

- 2026-10-06: disclosed

## References

- [https://nuget.org/packages](https://nuget.org/packages)
- [https://github.com/apache/logging-log4net/commit/dc5855a0720c91590fd7a81d729ea01fdd69e000](https://github.com/apache/logging-log4net/commit/dc5855a0720c91590fd7a81d729ea01fdd69e000)

## Related threats

- [Apache log4net improper character escaping in RemoteSyslogAppender](https://junglewise.ai/threats/cve-2026-105244-improper-encoding-or-escaping-of-output-vulnerability-in-the)
- [Apache log4net insufficient logging in EventLogAppender](https://junglewise.ai/threats/cve-2026-105243-insufficient-logging-vulnerability-in-the-eventlogappender-of)
- [Apache log4net improper handling of exceptions in aspnet-request pattern converter](https://junglewise.ai/threats/cve-2026-105242-improper-handling-of-exceptional-conditions-vulnerability-in-the)
- [Apache log4net improper Unicode encoding in SmtpPickupDirAppender](https://junglewise.ai/threats/cve-2026-105241-improper-handling-of-unicode-encoding-vulnerability-in-the)
- [Apache log4net null byte handling in OutputDebugStringAppender](https://junglewise.ai/threats/cve-2026-105240-improper-neutralization-of-null-byte-or-nul-character)