CVE-2026-105240

Katalog CVE

CVSS 5.3 · Medium EPSS 0,81%

Kerentanan Improper Neutralization of Null Byte or NUL Character pada apache log4net. Skor CVSS 3.1 5.3 (Medium) menurut apache.org.

Deskripsi (NVD)

Improper Neutralization of Null Byte or NUL Character vulnerability in the OutputDebugStringAppender of Apache log4net. A NUL character in logged content ended the debug output record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently lost. A party whose data reaches a log message could hide the rest of that record. Only applications on Windows that use OutputDebugStringAppender are affected. This issue affects Apache log4net: from 1.2.9 before 3.5.0. Users are recommended to upgrade to version 3.5.0, which fixes the issue.

Rincian

Terbit di NVD

6 Oktober 2026

Terakhir diubah

9 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber apache.org
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-158: Improper Neutralization of Null Byte or NUL Character

EPSS (30 hari)

0,81% peluang dieksploitasi; lebih tinggi dari 55,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.apache.org/thread.html/gyw2d4ppy82t1vlpdknkfd1nmzp21z17 mailing list · advisory vendor
• https://github.com/apache/logging-log4net/commit/6046fe9d7f353b49fe995361c071ec2eea8f7ef6 patch
• https://github.com/apache/logging-log4net/pull/315 patch
• http://www.openwall.com/lists/oss-security/2026/10/07/18 mailing list · advisory pihak ketiga