{"cve":"CVE-2026-105239","nvd":{"published":"2026-10-06T20:17:15.630","modified":"2026-10-09T15:44:02.503","status":"Analyzed","description":"Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net.\n\nA NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently not stored. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use EventLogAppender are affected.\n\nThis issue affects Apache log4net: from 1.2.9 before 3.5.0.\n\nUsers are recommended to upgrade to version 3.5.0, which fixes the issue.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3},"cwes":["CWE-158"],"references":["https://github.com/apache/logging-log4net/commit/dc5855a0720c91590fd7a81d729ea01fdd69e000","https://github.com/apache/logging-log4net/pull/315","https://lists.apache.org/thread.html/9fx1qo5hc0tg8ym0t6p9gt1zpb2qlxpq","http://www.openwall.com/lists/oss-security/2026/10/07/14"],"products":["apache:log4net"],"source":"nvd","synced_at":"2026-10-19T22:58:01.639778232+00:00"},"epss":{"cve":"CVE-2026-105239","score":0.00823,"percentile":0.57081,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}