Description
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Log4j2 | 2.0-beta9 – < log4j-core* | log4j-core* |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache-log4j2 | 2.15.0-1 | — |
| Debian 13 | apache-log4j2 | 2.15.0-1 | — |
| Debian 12 | apache-log4j2 | 2.15.0-1 | — |
| Debian 11 | apache-log4j2 | 2.15.0-1~deb11u1 | DSA-5020-1 |
| Debian 10 | apache-log4j2 | 2.15.0-1~deb10u1 | DSA-5020-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | apache-log4j2 | 2.7-2+deb9u1 | DLA-2842-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | apache-log4j2 | 2.15.0-0.20.04.1 | USN-5197-1, USN-5192-1 |
| Ubuntu 18.04 LTS | apache-log4j2 | 2.10.0-2ubuntu0.1 | USN-5192-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | apache-log4j2 | 2.4-2ubuntu0.1~esm1 | USN-5192-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-cxf +3 | 3.1.16-4.redhat_00003.1.ep7.el7 | RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-hal-console | 3.2.17-1.Final_redhat_00001.1.el7eap | RHSA-2025:1747 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-core +7 | 2.10.4-2.redhat_00004.1.el7eap | RHSA-2025:1747 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-databind | 2.8.11.6-2.SP1_redhat_00002.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-modules-base +1 | 2.10.4-4.redhat_00004.1.el7eap | RHSA-2025:1747 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jettison | 1.3.8-2.redhat_00002.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-netty +1 | 4.1.63-1.Final_redhat_00002.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-resteasy +16 | 3.0.27-1.Final_redhat_00001.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-resteasy-rxjava2 +2 | 3.11.6-1.Final_redhat_00001.1.el7eap | RHSA-2025:1747 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-snakeyaml | 1.33.0-1.SP1_redhat_00001.1.el7eap | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-velocity | 1.7.0-3.redhat_00006.1.ep7.el7 | RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.9-2.GA_redhat_00002.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-javadocs +2 | 7.3.12-3.GA_redhat_00002.1.el7eap | RHSA-2025:1747 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud Crowbar 9 | storm | 1.2.3-3.5.1 | SUSE-SU-2021:4097-1 |
| SUSE OpenStack Cloud Crowbar 8 | storm | 1.2.3-3.8.2 | SUSE-SU-2021:4096-1 |
| SUSE OpenStack Cloud 9 | storm | 1.2.3-3.5.1 | SUSE-SU-2021:4097-1 |
| SUSE OpenStack Cloud 9 | venv-openstack-monasca | 2.7.1~dev10-3.25.1 | SUSE-SU-2021:4097-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 8 | storm | 1.2.3-3.8.2 | SUSE-SU-2021:4096-1 |
| SUSE OpenStack Cloud 8 | venv-openstack-monasca | 2.2.2~dev1-11.32.1 | SUSE-SU-2021:4096-1 |
| SUSE HPE Helion OpenStack 8 | storm | 1.2.3-3.8.2 | SUSE-SU-2021:4096-1 |
| SUSE HPE Helion OpenStack 8 | venv-openstack-monasca | 2.2.2~dev1-11.32.1 | SUSE-SU-2021:4096-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | log4j | 2.13.2-2.1 | openSUSE-SU-2024:11666-1 |
| openSUSE Leap 15.3 | disruptor | 3.4.4-3.3.1 | openSUSE-SU-2021:4107-1 |
| openSUSE Leap 15.3 | jakarta-servlet | 5.0.0-5.3.1 | openSUSE-SU-2021:4107-1 |
| openSUSE Leap 15.3 | log4j | 2.13.0-4.3.1 | openSUSE-SU-2021:4107-1, openSUSE-SU-2021:4094-1, openSUSE-SU-2021:3999-1 |
| openSUSE Leap 15.3 | logback | 1.2.8-3.3.1 | openSUSE-SU-2021:4109-1 |
| openSUSE Leap 15.2 | disruptor | 3.4.4-lp152.2.3.1 | openSUSE-SU-2021:1601-1 |
| openSUSE Leap 15.2 | jakarta-servlet | 5.0.0-lp152.2.1 | openSUSE-SU-2021:1601-1 |
| openSUSE Leap 15.2 | log4j | 2.13.0-lp152.3.3.1 | openSUSE-SU-2021:1601-1, openSUSE-SU-2021:1586-1, openSUSE-SU-2021:1577-1 |
| openSUSE Leap 15.2 | logback | 1.2.8-lp152.2.3.2 | openSUSE-SU-2021:1613-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | aws-kinesis-agent | 2.0.4-1.amzn2 | ALAS2-2021-1730 |
| Amazon Linux 2 | java-1.7.0-openjdk +6 | 1:1.7.0.261-2.6.22.2.amzn2.0.2 | ALAS2-2021-1731 |
| Amazon Linux 2 | java-1.8.0-openjdk +15 | 1:1.8.0.312.b07-1.amzn2.0.2 | ALAS2-2021-1731 |
| Amazon Linux 2 | java-11-amazon-corretto +2 | 1:11.0.13+8-2.amzn2 | ALAS2-2021-1731 |
| Amazon Linux 2 | java-17-amazon-corretto +4 | 1:17.0.1+12-3.amzn2.1 | ALAS2-2021-1731 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 5 modules
-
Log4Shell HTTP Scanner
auxiliary/scanner/http/log4shell_scanner
-
UniFi Network Application Unauthenticated JNDI Injection RCE (via Log4Shell)
exploit/multi/http/ubiquiti_unifi_log4shell
-
VMware vCenter Server Unauthenticated JNDI Injection RCE (via Log4Shell)
exploit/multi/http/vmware_vcenter_log4shell
-
MobileIron Core Unauthenticated JNDI Injection RCE (via Log4Shell)
exploit/linux/http/mobileiron_core_log4shell
-
Log4Shell HTTP Header Injection
exploit/multi/http/log4shell_header_injection
Exploit-DB 3
- AD Manager Plus 7122 - Remote Code Execution (RCE) EDB-51183 · remote · Apr 1, 2023
- Apache Log4j2 2.14.1 - Information Disclosure EDB-50590 · remote · Dec 14, 2021
- Apache Log4j 2 - Remote Code Execution (RCE) EDB-50592 · remote · Dec 14, 2021
GitHub 508 repositories · most starred shown
-
fullhunt/log4j-scan ★ 3,424 · Dec 13, 2021
A fully automated, accurate, and extensive scanner for finding log4j RCE CVE-2021-44228
-
kozmer/log4j-shell-poc ★ 1,843 · Dec 10, 2021
A Proof-Of-Concept for the CVE-2021-44228 vulnerability.
-
christophetd/log4shell-vulnerable-app ★ 1,143 · Dec 10, 2021
Spring Boot web application vulnerable to Log4Shell (CVE-2021-44228).
-
Puliczek/CVE-2021-44228-PoC-log4j-bypass-words ★ 953 · Dec 10, 2021
🐱💻 ✂️ 🤬 CVE-2021-44228 - LOG4J Java exploit - WAF bypass tricks
-
logpresso/CVE-2021-44228-Scanner ★ 864 · Dec 11, 2021
Vulnerability scanner and mitigation patch for Log4j2 CVE-2021-44228
-
f0ng/log4j2burpscanner ★ 838 · Dec 11, 2021
CVE-2021-44228 Log4j2 BurpSuite Scanner,Customize ceye.io api or other apis,including internal networks
-
mergebase/log4j-detector ★ 642 · Dec 12, 2021
A public open sourced tool. Log4J scanner that detects vulnerable Log4J versions (CVE-2021-44228, CVE-2021-45046, etc) on your file-system within any application. It is able to even find Log4J instan…
-
corretto/hotpatch-for-apache-log4j2 ★ 498 · Dec 12, 2021
An agent to hotpatch the log4j RCE from CVE-2021-44228.
-
jas502n/Log4j2-CVE-2021-44228 ★ 467 · Dec 10, 2021
Remote Code Injection In Log4j
-
fox-it/log4j-finder ★ 439 · Dec 14, 2021
Find vulnerable Log4j2 versions on disk and also inside Java Archive Files (Log4Shell CVE-2021-44228, CVE-2021-45046, CVE-2021-45105)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Apache Log4j2 Remote Code Injection http/cves/2021/CVE-2021-44228.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | com.guicedee.services:log4j-core | <= 1.2.1.2-jre17 | — | GHSA-jfh8-c2jp-5v3q |
| Maven | org.apache.logging.log4j:log4j-core | >= 2.13.0, < 2.15.0 | 2.15.0 | GHSA-jfh8-c2jp-5v3q |
| Maven | org.apache.logging.log4j:log4j-core | >= 2.0-beta9, < 2.3.1 | 2.3.1 | GHSA-jfh8-c2jp-5v3q |
| Maven | org.apache.logging.log4j:log4j-core | >= 2.4, < 2.12.2 | 2.12.2 | GHSA-jfh8-c2jp-5v3q |
| Maven | org.ops4j.pax.logging:pax-logging-log4j2 | >= 1.8.0, < 1.9.2 | 1.9.2 | GHSA-jfh8-c2jp-5v3q |
| Maven | org.ops4j.pax.logging:pax-logging-log4j2 | >= 1.10.0, < 1.10.8 | 1.10.8 | GHSA-jfh8-c2jp-5v3q |
| Maven | org.ops4j.pax.logging:pax-logging-log4j2 | >= 1.11.0, < 1.11.10 | 1.11.10 | GHSA-jfh8-c2jp-5v3q |
| Maven | org.ops4j.pax.logging:pax-logging-log4j2 | >= 2.0.0, < 2.0.11 | 2.0.11 | GHSA-jfh8-c2jp-5v3q |
| Maven | org.xbib.elasticsearch:log4j | 6.3.2.1 | — | GHSA-jfh8-c2jp-5v3q |
| Maven | uk.co.nichesolutions.logging.log4j:log4j-core | 2.6.3-CUSTOM | — | GHSA-jfh8-c2jp-5v3q |
Advisories 32
- RHSA-2025:1747 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.12 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:1746 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- WID-SEC-2022-0351 Apache log4j: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Jul 7, 2026
- USN-5192-2 apache-log4j2 vulnerability Ubuntu Security Notices (USN) · Jun 25, 2026
- DSA-5020-1 apache-log4j2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2842-1 apache-log4j2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-5197-1 apache-log4j2 vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-5192-1 apache-log4j2 vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2021:4109-1 Security update for logback SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:1613-1 Security update for logback SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:3999-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:1586-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:4097-1 Security update for storm-kit SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:4096-1 Security update for storm SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:4107-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:1577-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:1601-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-0063 Juniper Junos Space: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 8, 2025
- VDE-2021-060 WAGO: Smart Script affected by Log4Shell Vulnerability CERT@VDE · May 22, 2025
- openSUSE-SU-2021:4094-1 Security update for log4j SUSE / openSUSE Security Updates · May 7, 2025
- openSUSE-SU-2024:11666-1 log4j-2.13.2-2.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- WID-SEC-2024-0064 Juniper Produkte: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 10, 2025
- SESB-2021-347-01 Apache Log4j Vulnerabilities (Log4Shell) Schneider Electric CPCERT · Aug 9, 2022
- SSA-661247 SSA-661247: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to Siemens Products Siemens ProductCERT · Aug 9, 2022
- ICSA-22-034-01 Sensormatic PowerManage (Update A) CISA ICS & IT advisories · Mar 8, 2022
- SSA-714170 SSA-714170: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to SPPA-T3000 Siemens ProductCERT · Feb 8, 2022
- SSA-479842 SSA-479842: Apache Log4j Vulnerabilities - Impact to Siemens Energy Sensformer / Sensgear (Platform, Basic and Advanced) Siemens ProductCERT · Dec 23, 2021
- ICSA-21-357-02 Johnson Controls exacq Enterprise Manager CISA ICS & IT advisories · Dec 23, 2021
- SSA-397453 SSA-397453: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to Siemens Energy TraceAlertServerPLUS Siemens ProductCERT · Dec 20, 2021
- ALAS2-2021-1731 Critical: java-17-amazon-corretto security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Dec 17, 2021
- SCA-2021-0003 SICK Security Advisory for Apache Log4j (CVE-2021-44228) SICK PSIRT · Dec 17, 2021
- ALAS2-2021-1730 Critical: aws-kinesis-agent security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Dec 16, 2021
References
- https://logging.apache.org/log4j/2.x/security.html
- [oss-security] 20211210 CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints mailing-list
- [oss-security] 20211210 Re: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints mailing-list
- 20211210 Vulnerability in Apache Log4j Library Affecting Cisco Products: December 2021 vendor-advisory
- [oss-security] 20211210 Re: CVE-2021-44228: Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints mailing-list
- https://security.netapp.com/advisory/ntap-20211210-0007/
- http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
- https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
- DSA-5020 vendor-advisory
- [debian-lts-announce] 20211212 [SECURITY] [DLA 2842-1] apache-log4j2 security update mailing-list
- FEDORA-2021-f0f501d01f vendor-advisory
- Microsoft’s Response to CVE-2021-44228 Apache Log4j 2 vendor-advisory
- [oss-security] 20211213 Re: CVE-2021-4104: Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 mailing-list
- [oss-security] 20211213 CVE-2021-4104: Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 mailing-list
- [oss-security] 20211214 CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack mailing-list
- VU#930724 third-party-advisory
- https://twitter.com/kurtseifried/status/1469345530182455296
- https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
- http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.html
- http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.html
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
- [oss-security] 20211215 Re: CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack mailing-list
- http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.html
- http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.html
- http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.html
- http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.html
- http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
- FEDORA-2021-66d6c484f3 vendor-advisory
- http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf
- https://www.oracle.com/security-alerts/cpujan2022.html
- http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.html
- https://github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.md
- http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.html
- 20220314 APPLE-SA-2022-03-14-7 Xcode 13.3 mailing-list
- https://www.bentley.com/en/common-vulnerability-exposure/be-2022-0001
- https://github.com/cisagov/log4j-affected-db
- https://support.apple.com/kb/HT213189
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228
- https://www.nu11secur1ty.com/2021/12/cve-2021-44228.html
- 20220721 Open-Xchange Security Advisory 2022-07-21 mailing-list
- http://packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.html
- http://packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.html
- 20221208 Intel Data Center Manager <= 5.1 Local Privileges Escalation mailing-list
- http://packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.html