Skip to content
OpenAdvisories
Medium · 6.3 CVE-2025-68161 EUVD-2025-204312GHSA-vc5p-v9hr-52mj

Apache Log4j Core: Missing TLS hostname verification in Socket appender

Published Dec 18, 2025 · Updated Apr 10, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Log4j Core Package: airflow-3 Package: airflow-3-bitnami-compat Package: akhq Package: apache-activemq-artemis Package: apache-activemq-artemis-compat Package: apache-log4j2 Package: apache-log4j2 Package: apache-tika-3.1 Package: apache-tika-3.1-compat Package: apache-tika-3.2 Package: apache-tika-3.2-compat Package: celeborn-0.6 Package: celeborn-0.6-compat Package: confluent-kafka Package: druid-compat Package: flink-2.1 Package: flink-2.2 Package: flink-2.2-compat Package: kafka_exporter-strimzi-compat Package: kafka-4.1 Package: kafka-iamguarded-compat-4.1 Package: kafka-strimzi-compat Package: kserve-modelmesh Package: kserve-modelmesh-compat Package: neo4j-2025.10 Package: neo4j-2025.10-browser Package: neo4j-2025.10-docker-publish Package: opensearch-2 Package: opensearch-3 Package: org.apache.logging.log4j:log4j-core Package: prometheus-jmx-exporter-strimzi-compat Package: sonarqube Package: spark-4.0 Package: spark-4.0-scala-2.13 Package: spark-4.0-scala-2.13-compat Package: strimzi-kafka-operator Package: strimzi-kafka-operator-cluster-operator Package: strimzi-kafka-operator-kafka-agent Package: strimzi-kafka-operator-kafka-base Package: strimzi-kafka-operator-kafka-init Package: strimzi-kafka-operator-kafka-thirdparty-libs Package: strimzi-kafka-operator-kafka-thirdparty-libs-cc Package: strimzi-kafka-operator-topic-operator Package: strimzi-kafka-operator-tracing-agent Package: strimzi-kafka-operator-user-operator Package: wavefront-proxy Package: wavefront-proxy-compat Package: wavefront-proxy-config Package: wavefront-proxy-licenses Package: zipkin Package: zipkin-oci-entrypoint Package: zipkin-slim Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true.

This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:

* The attacker is able to intercept or redirect network traffic between the client and the log receiver.
* The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).

Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.

As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Log4j Core 2.0-beta9 – < 2.25.3, 3.0.0-alpha1 – ≤ 3.0.0-beta3 2.25.3

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 apache-log4j2 No fix yet —
Debian 13 apache-log4j2 No fix yet —
Debian 12 apache-log4j2 No fix yet —
Debian 11 apache-log4j2 2.17.1-1~deb11u2 DLA-4444-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 apache-log4j2 No fix yet —
Ubuntu 26.04 LTS apache-log4j2 No fix yet —
Ubuntu 25.10 apache-log4j2 No fix yet —
Ubuntu 24.04 LTS apache-log4j2 No fix yet —
Ubuntu 22.04 LTS apache-log4j2 No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS apache-log4j2 No fix yet —
Ubuntu 18.04 LTS apache-log4j2 No fix yet —
Ubuntu Pro 16.04 LTS apache-log4j2 No fix yet —

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 log4j 2.20.0-150200.4.30.1 SUSE-SU-2026:0254-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed log4j 2.20.0-1.1 openSUSE-SU-2026:10009-1
openSUSE Leap 16.0 coredns 1.14.0-bp160.1.1 openSUSE-SU-2026:20099-1
openSUSE Leap 15.6 log4j 2.20.0-150200.4.30.1 SUSE-SU-2026:0254-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 log4j +2 2.17.2-1.amzn2023.0.5 ALAS2023-2026-1398

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling airflow-3 3.2.0-r0 —
Wolfi rolling airflow-3-bitnami-compat No fix yet —
Wolfi rolling akhq 0.27.0-r1 —
Wolfi rolling apache-activemq-artemis +1 2.44.0-r2 —
Wolfi rolling apache-tika-3.1 +1 3.1.0-r17 —
Wolfi rolling apache-tika-3.2 +1 3.2.3-r2 —
Wolfi rolling celeborn-0.6 +1 0.6.2-r3 —
Wolfi rolling confluent-kafka 8.3.0.99-r0 —
Wolfi rolling druid-compat 35.0.1-r2 —
Wolfi rolling flink-2.1 2.1.1-r2 —
Wolfi rolling flink-2.2 +1 2.2.0-r1 —
Wolfi rolling kafka-4.1 +1 4.1.1-r1 —
Wolfi rolling kafka-strimzi-compat +12 0.49.1-r2 —
Wolfi rolling kserve-modelmesh +1 0.12.0-r20 —
Wolfi rolling neo4j-2025.10 +2 2025.10.1-r3 —
Wolfi rolling opensearch-2 2.19.4-r6 —
Wolfi rolling opensearch-3 3.5.0-r0 —
Wolfi rolling sonarqube 25.12.0.117093-r1 —
Wolfi rolling spark-4.0 +2 4.0.1-r4 —
Wolfi rolling wavefront-proxy +3 13.9-r2 —
Wolfi rolling zipkin +2 3.5.1-r10 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.logging.log4j:log4j-core >= 2.0-beta9, < 2.25.3 2.25.3 GHSA-vc5p-v9hr-52mj

Advisories 40

References