CYBERSECURITYTRACKER
Permanent story citation

CVE-2026-105240: Apache log4net: NUL character truncates OutputDebugStringAppender records

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 9578

As cited

Copy frozen at (site build).

vulnerabilities

CVE-2026-105240: Apache log4net: NUL character truncates OutputDebugStringAppender records

A null byte character in logged content can prematurely terminate debug output in Apache log4net's OutputDebugStringAppender, potentially hiding subsequent log records. The vulnerability affects versions 1.2.9 through 3.4.1 and carries a CVSS 3.1 score of 5.3 (medium).

Why it matters: Operators using log4net for application logging and debugging need to upgrade to version 3.5.0 or later to ensure debug output is not truncated by malicious or unexpected null characters in logged data.

CVEsCVE-2026-105240
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary