Description
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Log4j | Apache Log4j2 – < 2.16.0 | 2.16.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache-log4j2 | 2.16.0-1 | — |
| Debian 13 | apache-log4j2 | 2.16.0-1 | — |
| Debian 12 | apache-log4j2 | 2.16.0-1 | — |
| Debian 11 | apache-log4j2 | 2.16.0-1~deb11u1 | DSA-5022-1 |
| Debian 10 | apache-log4j2 | 2.16.0-1~deb10u1 | DSA-5022-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | apache-log4j2 | 2.16.0-0.20.04.1 | USN-5197-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-apache-cxf +3 | 3.1.16-4.redhat_00003.1.ep7.el7 | RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-hal-console | 3.2.17-1.Final_redhat_00001.1.el7eap | RHSA-2025:1747 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-core +7 | 2.10.4-2.redhat_00004.1.el7eap | RHSA-2025:1747 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-databind | 2.8.11.6-2.SP1_redhat_00002.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jackson-modules-base +1 | 2.10.4-4.redhat_00004.1.el7eap | RHSA-2025:1747 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-jettison | 1.3.8-2.redhat_00002.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-netty +1 | 4.1.63-1.Final_redhat_00002.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-resteasy +16 | 3.0.27-1.Final_redhat_00001.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-resteasy-rxjava2 +2 | 3.11.6-1.Final_redhat_00001.1.el7eap | RHSA-2025:1747 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-snakeyaml | 1.33.0-1.SP1_redhat_00001.1.el7eap | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-velocity | 1.7.0-3.redhat_00006.1.ep7.el7 | RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly +1 | 7.1.9-2.GA_redhat_00002.1.ep7.el7 | RHSA-2025:1747, RHSA-2025:1746 |
| Red Hat Jboss Enterprise Application Platform Eus 7 | eap7-wildfly-javadocs +2 | 7.3.12-3.GA_redhat_00002.1.el7eap | RHSA-2025:1747 |
| Red Hat JBoss EAP 7 | eap7-log4j | 2.17.1-1.redhat_00001.1.el7eap | RHSA-2022:1297, RHSA-2022:1296 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | log4j | 2.16.0-2.1 | openSUSE-SU-2024:11681-1 |
| openSUSE Leap 15.3 | disruptor | 3.4.4-3.3.1 | openSUSE-SU-2021:4107-1 |
| openSUSE Leap 15.3 | jakarta-servlet | 5.0.0-5.3.1 | openSUSE-SU-2021:4107-1 |
| openSUSE Leap 15.3 | log4j | 2.13.0-4.6.1 | openSUSE-SU-2021:4107-1, openSUSE-SU-2021:4094-1 |
| openSUSE Leap 15.2 | disruptor | 3.4.4-lp152.2.3.1 | openSUSE-SU-2021:1601-1 |
| openSUSE Leap 15.2 | jakarta-servlet | 5.0.0-lp152.2.1 | openSUSE-SU-2021:1601-1 |
| openSUSE Leap 15.2 | log4j | 2.16.0-lp152.3.9.1 | openSUSE-SU-2021:1601-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | aws-kinesis-agent | 2.0.4-1.amzn2 | ALAS2-2021-1730 |
| Amazon Linux 2 | java-1.7.0-openjdk +6 | 1:1.7.0.261-2.6.22.2.amzn2.0.2 | ALAS2-2021-1731 |
| Amazon Linux 2 | java-1.8.0-openjdk +15 | 1:1.8.0.312.b07-1.amzn2.0.2 | ALAS2-2021-1731 |
| Amazon Linux 2 | java-11-amazon-corretto +2 | 1:11.0.13+8-2.amzn2 | ALAS2-2021-1731 |
| Amazon Linux 2 | java-17-amazon-corretto +4 | 1:17.0.1+12-3.amzn2.1 | ALAS2-2021-1731 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Log4Shell HTTP Scanner
auxiliary/scanner/http/log4shell_scanner
GitHub 11 repositories · most starred shown
-
lijiejie/log4j2_vul_local_scanner ★ 85 · Dec 20, 2021
Log4j 漏洞本地检测脚本。 Scan all java processes on your host to check whether it's affected by log4j2 remote code execution vulnerability (CVE-2021-45046)
-
cckuailong/Log4j_CVE-2021-45046 ★ 22 · Dec 15, 2021
Log4j 2.15.0 Privilege Escalation -- CVE-2021-45046
-
mergebase/log4j-samples ★ 14 · Dec 16, 2021
Public testing data. Samples of log4j library versions to help log4j scanners / detectors improve their accuracy for detecting CVE-2021-45046 and CVE-2021-44228. TAG_TESTING, OWNER_KEN, DC_PUBLIC
-
ifconfig-me/Log4Shell-Payloads ★ 8 · Jul 23, 2025
Log4Shell / Log4J Payload - CVE-2021-45046 and CVE-2022-42889
-
BobTheShoplifter/CVE-2021-45046-Info ★ 4 · Dec 15, 2021
Oh no another one
-
CaptanMoss/Log4Shell-Sandbox-Signature ★ 1 · Dec 24, 2021
Log4Shell(CVE-2021-45046) Sandbox Signature
-
ludy-dev/cve-2021-45046 ★ 1 · Dec 18, 2021
-
lukepasek/log4jjndilookupremove ★ 0 · Dec 17, 2021
A simple script to remove Log4J JndiLookup.class from jars in a given directory, to temporarily protect from CVE-2021-45046 and CVE-2021-44228.
-
tejas-nagchandi/CVE-2021-45046 ★ 0 · Dec 15, 2021
Replicating CVE-2021-45046
-
pravin-pp/log4j2-CVE-2021-45046 ★ 0 · Dec 15, 2021
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Apache Log4j2 - Remote Code Injection http/cves/2021/CVE-2021-45046.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.logging.log4j:log4j-core | >= 2.13.0, < 2.16.0 | 2.16.0 | GHSA-7rjr-3q55-vv33 |
| Maven | org.apache.logging.log4j:log4j-core | >= 2.4.0, < 2.12.2 | 2.12.2 | GHSA-7rjr-3q55-vv33 |
| Maven | org.apache.logging.log4j:log4j-core | < 2.3.1 | 2.3.1 | GHSA-7rjr-3q55-vv33 |
| Maven | org.ops4j.pax.logging:pax-logging-log4j2 | >= 1.8.0, < 1.9.2 | 1.9.2 | GHSA-7rjr-3q55-vv33 |
| Maven | org.ops4j.pax.logging:pax-logging-log4j2 | >= 1.10.0, < 1.10.8 | 1.10.8 | GHSA-7rjr-3q55-vv33 |
| Maven | org.ops4j.pax.logging:pax-logging-log4j2 | >= 1.11.0, < 1.11.11 | 1.11.11 | GHSA-7rjr-3q55-vv33 |
| Maven | org.ops4j.pax.logging:pax-logging-log4j2 | >= 2.0.0, < 2.0.12 | 2.0.12 | GHSA-7rjr-3q55-vv33 |
Advisories 21
- RHSA-2025:1747 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.3.12 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2025:1746 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.9 on RHEL 7 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2022:1296 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.4 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:1297 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.4 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2026-1203 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- DSA-5022-1 apache-log4j2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-5197-1 apache-log4j2 vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:11681-1 log4j-2.16.0-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:4107-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:1601-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-0352 Apache log4j: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Nov 5, 2025
- WID-SEC-2023-0063 Juniper Junos Space: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 8, 2025
- VDE-2021-060 WAGO: Smart Script affected by Log4Shell Vulnerability CERT@VDE · May 22, 2025
- openSUSE-SU-2021:4094-1 Security update for log4j SUSE / openSUSE Security Updates · May 7, 2025
- SESB-2021-347-01 Apache Log4j Vulnerabilities (Log4Shell) Schneider Electric CPCERT · Aug 9, 2022
- SSA-661247 SSA-661247: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to Siemens Products Siemens ProductCERT · Aug 9, 2022
- SSA-714170 SSA-714170: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to SPPA-T3000 Siemens ProductCERT · Feb 8, 2022
- SSA-479842 SSA-479842: Apache Log4j Vulnerabilities - Impact to Siemens Energy Sensformer / Sensgear (Platform, Basic and Advanced) Siemens ProductCERT · Dec 23, 2021
- SSA-397453 SSA-397453: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to Siemens Energy TraceAlertServerPLUS Siemens ProductCERT · Dec 20, 2021
- ALAS2-2021-1731 Critical: java-17-amazon-corretto security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Dec 17, 2021
- ALAS2-2021-1730 Critical: aws-kinesis-agent security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Dec 16, 2021
References
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
- https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
- https://www.cve.org/CVERecord?id=CVE-2021-44228
- [oss-security] 20211214 CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack mailing-list
- https://logging.apache.org/log4j/2.x/security.html
- VU#930724 third-party-advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html
- 20211210 Vulnerabilities in Apache Log4j Library Affecting Cisco Products: December 2021 vendor-advisory
- [oss-security] 20211215 Re: CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack mailing-list
- https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
- DSA-5022 vendor-advisory
- [oss-security] 20211218 Re: CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack mailing-list
- https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf
- FEDORA-2021-5c9d12a93e vendor-advisory
- FEDORA-2021-abbe24e41c vendor-advisory
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://security.gentoo.org/glsa/202310-16