Medium DSA-5024-1 1 CVE

apache-log4j2 - security update

Published Dec 18, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

Release	Package	Fixed in
Debian · 10	apache-log4j2	2.17.0-1~deb10u1
Debian · 11	apache-log4j2	2.17.0-1~deb11u1

Vulnerabilities 1

Medium 5.9

CVE-2021-45105 Public exploit EPSS 100%

Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a craf…

Apache Software Foundation Apache Log4j2 apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven

Dec 18, 2021