CVE-2026-105239

Executive Summary

CVE-2026-105239 is an improper neutralization of a NUL (null byte) character vulnerability (CWE-158) in the EventLogAppender component of Apache log4net. When a logged message contains a NUL character, the Windows Event Log record is truncated at that byte, causing all layout-rendered content after it — including exception text and trailing fields — to be silently dropped. Applications running on Windows that use EventLogAppender are affected in versions from 1.2.9 before 3.5.0, and the primary risk is integrity loss of audit/log data that defenders rely on for detection and forensic reconstruction.

Technical Analysis

Apache log4net is a logging framework for .NET applications. Its EventLogAppender writes log events into the Windows Event Log. The vulnerability class is CWE-158, "Improper Neutralization of Null Byte or NUL Character." The NVD description states plainly that "A NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently not stored."

The mechanism is a classic string-boundary defect interacting with an API that treats NUL as a terminator. The Windows Event Log write path, as invoked by EventLogAppender, terminates record content at the first embedded NUL byte rather than storing the full rendered layout string. Because log4net layouts render a message into a formatted string that is then handed to the event log, any NUL embedded anywhere in that rendered output — for example inside attacker-influenced data that reaches a log statement — truncates the stored record.

Two properties make this significant:

1. Silent truncation, not an error. The description states the trailing content "was silently not stored." No exception is raised to the caller, so applications have no signal that their audit record is incomplete.
2. Attacker-reachable if attacker data reaches a log message. The description explicitly notes that "A party whose data reaches a log message could hide the rest of that record." This is the core of the integrity impact: the party controlling the input can decide where the record ends.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (base 5.3) is consistent with this reading: remotely reachable, low complexity, no privileges or user interaction, scope unchanged, no confidentiality impact, low integrity impact, no availability impact. The integrity weakness is scored Low because only the completeness of a log record is affected — not authentication, execution, or data store contents.

Important constraints from the provided data:

• Scope is Windows only: "Only applications on Windows that use EventLogAppender are affected."
• Affected range is 1.2.9 before 3.5.0.
• No public PoC, no Nuclei template, and no exploit code are known from the supplied dataset.
• No CNA title was provided, and no specific code symbols (method names, layout class names, patch commit identifiers) beyond EventLogAppender itself are available. No further implementation-level detail should be inferred.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-158) and the NVD description. It deliberately avoids inventing function names, parameters, or endpoints that are not present in the source data.

1. Reconnaissance / target identification. An adversary identifies a Windows-hosted .NET application that (a) runs on Windows, (b) uses log4net within the affected range (1.2.9 to before 3.5.0), and (c) is configured with EventLogAppender to write into the Windows Event Log. The presence of EventLogAppender in application logging configuration is the true precondition; the NVD description limits scope explicitly to that appender.

2. Triggering the flaw class. The attacker supplies input that (i) reaches a log message — i.e., the application writes attacker-controlled data via log4net — and (ii) contains a NUL character. Because the application author does not neutralize the NUL byte, the rendered layout string handed to the Windows Event Log contains an embedded NUL.

3. Payload / execution method (vulnerability-class level). There is no code execution here. The "payload" is a NUL byte placed inside otherwise ordinary logged content. The effect is data-driven: the Windows Event Log record terminates at the NUL, and per the description everything the layout rendered after that point — including exception text and trailing fields — is not stored. The attacker does not need privileges or user interaction (PR:N/UI:N), only a path by which their data becomes part of a log line in an affected Windows application.

4. Post-exploitation impact. The attacker achieves log-record suppression: specific events, exception details, or trailing fields can be selectively hidden from the Windows Event Log while the application continues to operate without error. This degrades downstream detection and forensic completeness. It may also be used to conceal other activity by ensuring the incriminating portion of a log entry never lands in the event log. There is no confidentiality or availability impact per the CVSS vector; the outcome is an integrity (completeness) problem in the audit trail.

Impact Assessment

• Integrity (Low, per CVSS I:L). The affected record is truncated; trailing fields, including exception text, are dropped silently. Logs remain present but incomplete, which is often harder to notice than a missing event.
• Confidentiality: None (C:N). No data is exposed to the attacker through this flaw.
• Availability: None (A:N). The application continues to run; there is no crash or DoS described.
• Attack vector: Network (AV:N), low complexity (AC:L), no privileges (PR:N), no user interaction (UI:N), scope unchanged (S:U). Base score: 5.3 (Medium).
• Blast radius. Any Windows deployment whose .NET applications use log4net EventLogAppender on an affected version — 1.2.9 up to but not including 3.5.0. The downstream impact is concentrated in the security-monitoring and incident-response pipeline, where Windows Event Log records are a primary source of evidence and alerting. Third-party log collectors, SIEM ingestion, and compliance evidence based on the Windows Event Log may all silently lose the truncated field content.
• Strategic impact. For a defender, a log source that can be selectively truncated by an unprivileged remote party is a trust problem: the absence of an event or of trailing exception fields cannot be taken as evidence that nothing occurred.

Detection Guidance

The detection strategy targets the byte-level artifact (an embedded NUL in log content) rather than a public exploit signature, since no PoC or Nuclei template exists. Because the effect is silent truncation, network and host detections must focus on the ingestion path and on Windows Event Log integrity. The rules below are generic, realistic templates for this vulnerability class and should be tuned to the environment.

Sigma Rule

title: Suspected NUL Byte Log Truncation Against Apache log4net EventLogAppender
id: 8f2c1a44-0d7b-4e51-9c3a-105239000001
status: experimental
description: Detects process or command lines and application logging inputs containing an embedded NUL byte adjacent to log-related content, consistent with CVE-2026-105239 (CWE-158) truncation of Windows Event Log records written via log4net EventLogAppender on affected versions 1.2.9 - < 3.5.0.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105239
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1070
  - cwe.158
logsource:
  product: windows
  category: process_creation
detection:
  selection_nul:
    CommandLine|contains:
      - '\x00'
      - '%00'
      - '%%00'
  filter_benign:
    Image|endswith:
      - '\svchost.exe'
      - '\conhost.exe'
  condition: selection_nul and not filter_benign
falsepositives:
  - Legitimate binary protocols or encoded arguments that legitimately contain NUL escape sequences
  - Security testing tools
level: medium

YARA Rule

rule CVE_2026_105239_Log4Net_NUL_Log_Truncation
{
    meta:
        description = "Detects embedded NUL bytes in rendered log strings intended for Apache log4net EventLogAppender (CVE-2026-105239, CWE-158). Affected log4net versions 1.2.9 - < 3.5.0 on Windows."
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105239"
        cwe = "CWE-158"
        severity = "medium"

    strings:
        $nul = { 00 }
        $logterm1 = "EventLogAppender" ascii nocase
        $logterm2 = "log4net" ascii nocase
        $logterm3 = "exception" ascii nocase
        $logterm4 = "System.Exception" ascii nocase

    condition:
        $nul and any of ($logterm*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105239 Apache log4net EventLogAppender NUL Byte Log Truncation Attempt"; flow:established,to_server; http.request_body; content:"|00|"; http.request_body; pcre:"/(?:log4net|EventLogAppender)/i"; classtype:attempted-recon; reference:cve,2026-105239; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-105239; metadata:affected_product "Apache log4net", affected_versions "1.2.9 - < 3.5.0", cwe "CWE-158"; sid:10523901; rev:1;)

Elastic Detection

sequence by host.id, process.entity_id with maxspan=5s
  [ process where event.category == "process" and
      process.command_line : ("*%00*", "*\\x00*") ]
  [ file where event.category == "file" and
      file.name : ("*.log", "*.evtx") and
      process.command_line : ("*log4net*", "*EventLogAppender*") ]

Splunk SPL Query

index=windows (source="WinEventLog:*" OR source="XmlWinEventLog:*")
| eval has_nul = if(match(_raw, "\x00") OR match(_raw, "%00"), 1, 0)
| where has_nul=1
| stats count min(_time) as first_seen max(_time) as last_seen by host, source, EventCode, Provider_Name
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="windows,log4net,cve-2026-105239,">
  <rule id="105239" level="10">
    <decoded_as>windows_eventchannel</decoded_as>
    <field name="win.system.providerName">\.NET Runtime|Application|Application Error</field>
    <match>EventLogAppender|log4net</match>
    <description>CVE-2026-105239: Possible NUL byte truncation of Windows Event Log record via Apache log4net EventLogAppender</description>
    <mitre>
      <id>T1070</id>
    </mitre>
    <group>cwe_158,log_integrity_loss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states that users should upgrade to version 3.5.0, which fixes the issue, and that affected range is 1.2.9 before 3.5.0. However, no vendor advisory, commit, or OSV entry was supplied in the provided dataset to independently confirm patch availability; validate against the official Apache log4net release before relying on it. No workaround is provided in the source data.

1. Immediate mitigations

   • Verify whether Windows-hosted .NET applications in scope use log4net within the affected range (1.2.9 to before 3.5.0) and are configured with EventLogAppender. That combination is the explicit precondition.
   • Where feasible, avoid routing attacker-influenced data through EventLogAppender records until upgraded; alternative appenders may not exhibit this NUL-truncation behavior, but this should be validated locally rather than assumed.
   • Sanitize or reject NUL bytes in input that can reach log statements, and treat the resulting records as potentially incomplete rather than authoritative.
   • Tighten monitoring of Windows Event Log completeness (sequence gaps, missing trailing fields, unexpected short records) since truncation is silent and generates no error.

2. Patch / upgrade steps

   • Upgrade Apache log4net to 3.5.0 as recommended in the NVD description.
   • Inventory all .NET dependencies and transitive references; confirm no application remains pinned to a version in the 1.2.9–<3.5.0 range.
   • After upgrade, validate that NUL-containing content is handled without truncating the stored Windows Event Log record, in both staging and production.

3. Long-term hardening

   • Treat Windows Event Log output as an integrity-sensitive data source: centralize collection (SIEM/forwarder) and alert on record anomalies to reduce the window in which silent truncation can hide activity.
   • Enforce input normalization at trust boundaries so that control characters, including NUL, cannot silently reach structured log sinks.
   • Track Apache log4net advisories as part of dependency governance and apply a consistent library-version policy across .NET services on Windows.

References

• NVD — CVE-2026-105239: https://nvd.nist.gov/vuln/detail/CVE-2026-105239
• MITRE CWE-158 — Improper Neutralization of Null Byte or NUL Character: https://cwe.mitre.org/data/definitions/158.html
• Apache log4net project (upgrade target 3.5.0, per NVD description): https://logging.apache.org/log4net/
• FIRST EPSS — not yet scored for this CVE at time of writing; monitor https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog — not listed (no KEV entry for this CVE). No public PoC, Nuclei template, or exploit-in-the-wild evidence is present in the provided dataset as of this report.