Apache Log4j vulnerabilities

2 known vulnerabilities in Apache Log4j from Apache. 2 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Apache Log4j: Deserialization of Untrusted Data

  CVE-2023-26464Mar 10, 2023ApacheEPSS 1.91%

  ** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested) hashmap or hashtable (depending on whi

• 9.0 Critical severity

  Apache Log4j2 Deserialization of Untrusted Data Exploited

  CVE-2021-45046Dec 14, 2021ApacheEPSS 100%

  It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default