Description
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Log4j2 | log4j-core – < 2.17.0 | 2.17.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apache-log4j2 | 2.17.0-1 | — |
| Debian 13 | apache-log4j2 | 2.17.0-1 | — |
| Debian 12 | apache-log4j2 | 2.17.0-1 | — |
| Debian 11 | apache-log4j2 | 2.17.0-1~deb11u1 | DSA-5024-1 |
| Debian 10 | apache-log4j2 | 2.17.0-1~deb10u1 | DSA-5024-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | apache-log4j2 | 2.12.3-0+deb9u1 | DLA-2852-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | apache-log4j2 | 2.17.0-0.20.04.1 | USN-5222-1, USN-5203-1 |
| Ubuntu 18.04 LTS | apache-log4j2 | 2.12.4-0ubuntu0.1 | USN-5222-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | apache-log4j2 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 15.0.6-1.redhat_00001.1.el7sso | RHSA-2022:1463, RHSA-2022:1462 |
| Red Hat JBoss EAP 7 | eap7-log4j | 2.17.1-1.redhat_00001.1.el7eap | RHSA-2022:1297, RHSA-2022:1296 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.3 | log4j | 2.17.0-4.13.1 | openSUSE-SU-2021:4118-1 |
| openSUSE Leap 15.2 | log4j | 2.17.0-lp152.3.12.1 | openSUSE-SU-2021:1605-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | aws-kinesis-agent | 2.0.5-1.amzn2 | ALAS2-2021-1733 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 7 repositories
-
cckuailong/Log4j_dos_CVE-2021-45105 ★ 13 · Dec 18, 2021
Log4j_dos_CVE-2021-45105
-
iAmSOScArEd/log4j2_dos_exploit ★ 3 · Dec 20, 2021
log4j2 dos exploit,CVE-2021-45105 exploit,Denial of Service poc
-
name/log4j-remediation ★ 2 · Dec 23, 2021
Discover and remediate Log4Shell vulnerability [CVE-2021-45105]
-
aajuvonen/CVE-2021-45105-demo ★ 0 · Apr 3, 2022
Example payloads for CVE-2021-45105 low complexity vector
-
dileepdkumar/https-github.com-pravin-pp-log4j2-CVE-2021-45105-1 ★ 0 · Dec 23, 2021
-
tejas-nagchandi/CVE-2021-45105 ★ 0 · Dec 19, 2021
Replicating CVE-2021-45105
-
pravin-pp/log4j2-CVE-2021-45105 ★ 0 · Dec 18, 2021
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.logging.log4j:log4j-core | >= 2.4.0, < 2.12.3 | 2.12.3 | GHSA-p6xc-xr62-6r2g |
| Maven | org.apache.logging.log4j:log4j-core | >= 2.13.0, < 2.17.0 | 2.17.0 | GHSA-p6xc-xr62-6r2g |
| Maven | org.apache.logging.log4j:log4j-core | < 2.3.1 | 2.3.1 | GHSA-p6xc-xr62-6r2g |
| Maven | org.ops4j.pax.logging:pax-logging-log4j2 | >= 1.8.0, < 1.9.2 | 1.9.2 | GHSA-p6xc-xr62-6r2g |
| Maven | org.ops4j.pax.logging:pax-logging-log4j2 | >= 1.10.0, < 1.10.9 | 1.10.9 | GHSA-p6xc-xr62-6r2g |
| Maven | org.ops4j.pax.logging:pax-logging-log4j2 | >= 1.11.0, < 1.11.12 | 1.11.12 | GHSA-p6xc-xr62-6r2g |
| Maven | org.ops4j.pax.logging:pax-logging-log4j2 | >= 2.0.0, < 2.0.13 | 2.0.13 | GHSA-p6xc-xr62-6r2g |
Advisories 19
- RHSA-2022:1296 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.4 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:1297 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.4 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:1463 Red Hat Security Advisory: Red Hat Single Sign-On 7.5.2 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Sep 4, 2026
- RHSA-2022:1462 Red Hat Security Advisory: Red Hat Single Sign-On 7.5.2 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Sep 4, 2026
- WID-SEC-2026-0162 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 24, 2026
- USN-5222-1 apache-log4j2 vulnerabilities Ubuntu Security Notices (USN) · Jun 1, 2026
- USN-5203-1 apache-log4j2 vulnerability Ubuntu Security Notices (USN) · Jun 1, 2026
- DSA-5024-1 apache-log4j2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-2852-1 apache-log4j2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2021:1605-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2021:4118-1 Security update for log4j SUSE / openSUSE Security Updates · Feb 4, 2026
- NCSC-2026-0027 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Jan 21, 2026
- WID-SEC-2022-0811 Apache log4j: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 5, 2025
- VDE-2021-060 WAGO: Smart Script affected by Log4Shell Vulnerability CERT@VDE · May 22, 2025
- WID-SEC-2023-0119 Oracle Utilities Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 17, 2023
- SESB-2021-347-01 Apache Log4j Vulnerabilities (Log4Shell) Schneider Electric CPCERT · Aug 9, 2022
- ALAS2-2021-1733 Moderate: aws-kinesis-agent security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Dec 23, 2021
- SSA-479842 SSA-479842: Apache Log4j Vulnerabilities - Impact to Siemens Energy Sensformer / Sensgear (Platform, Basic and Advanced) Siemens ProductCERT · Dec 23, 2021
- SSA-501673 SSA-501673: Apache Log4j Denial of Service Vulnerability (CVE-2021-45105) - Impact to Siemens Products Siemens ProductCERT · Dec 19, 2021
References
- https://logging.apache.org/log4j/2.x/security.html
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
- VU#930724 third-party-advisory
- 20211210 Vulnerabilities in Apache Log4j Library Affecting Cisco Products: December 2021 vendor-advisory
- [oss-security] 20211218 CVE-2021-45105: Apache Log4j2 does not always protect from infinite recursion in lookup evaluation mailing-list
- DSA-5024 vendor-advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf
- https://security.netapp.com/advisory/ntap-20211218-0001/
- https://www.zerodayinitiative.com/advisories/ZDI-21-1541/
- https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html