Medium DLA-4444-1 1 CVE

apache-log4j2 - security update

Published Jan 19, 2026 · Updated Jan 19, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 11	apache-log4j2	2.17.1-1~deb11u2

Vulnerabilities 1

Medium 6.3

CVE-2025-68161

Apache Log4j Core: Missing TLS hostname verification in Socket appender

The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-att…

Apache Software Foundation Apache Log4j Core airflow-3 celeborn-0.6 Debian Ubuntu Wolfi Maven

Dec 18, 2025