CVE-2026-105243

The Apache log4net logging framework (versions 1.2.9 before 3.5.0 ) contains an Insufficient Logging vulnerability in the EventLogAppender component on Windows. The root cause is that long messages are truncated to a fixed size that exceeds the Windows Event Log capacity once log and source names...

EUVD-2026-93869

Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data...

CVE-2026-105243 Apache log4net: Oversize EventLogAppender record silently discarded

Insufficient Logging vulnerability in the EventLogAppender of Apache log4net. Long messages were truncated to a fixed size that exceeds what the Windows Event Log accepts once the log and source names are counted, and the event log then stored nothing and reported nothing. A party whose data...

CVE-2026-105239 Apache log4net: NUL character truncates EventLogAppender records

Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net. A NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently...

CVE-2026-105239

The Apache log4net library (versions 1.2.9 through 3.5.0) is vulnerable to an Improper Neutralization of Null Byte or NUL Character in the EventLogAppender . When a NUL character is present in logged content, it prematurely terminates the Windows Event Log record, causing subsequent data—such as ...

EUVD-2026-93863

Improper Neutralization of Null Byte or NUL Character vulnerability in the EventLogAppender of Apache log4net. A NUL character in logged content ended the Windows Event Log record at that point, so everything the layout rendered after it, including exception text and trailing fields, was silently...