CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

Summary

Apache Log4j2, a Java logging library, is affected when it uses a non-default pattern layout that includes Thread Context Map or Context Lookup patterns. An attacker who can control logged input could leak sensitive information, and could run code remotely in some environments or locally in all environments.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

Timeline

Dec 14, 2021, 4:55 PM UTCCVE published
May 1, 2023Added to CISA KEV
CISA has evidence of exploitation in the wild
May 22, 2023CISA remediation deadline
Due date for US federal agencies to patch
Oct 21, 2025, 11:25 PM UTCRecord last updated
Oct 22, 2026EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

Apache Software Foundation Apache Log4j
From Apache Log4j2 · fixed in 2.16.0
org.apache.logging.log4j:log4j-coreMaven
From 2.13.0 · fixed in 2.16.0
org.apache.logging.log4j:log4j-coreMaven
From 2.4.0 · fixed in 2.12.2
org.ops4j.pax.logging:pax-logging-log4j2Maven
From 1.8.0 · fixed in 1.9.2
org.ops4j.pax.logging:pax-logging-log4j2Maven
From 1.10.0 · fixed in 1.10.8
org.ops4j.pax.logging:pax-logging-log4j2Maven
From 1.11.0 · fixed in 1.11.11
org.ops4j.pax.logging:pax-logging-log4j2Maven
From 2.0.0 · fixed in 2.0.12
org.apache.logging.log4j:log4j-coreMaven
fixed in 2.3.1

References 21

psirt.global.sonicwall.com

vuln-detail/SNWLID-2021-0032

oracle.com

cve.org

CVERecord?id=CVE-2021-44228

openwall.com

logging.apache.org

log4j/2.x/security.html

kb.cert.org

vuls/id/930724

cert-portal.siemens.com

lists.fedoraproject.org

security.gentoo.org

glsa/202310-16

FAQ

Questions about CVE-2021-45046

What does this mean?

Crafted malicious input data that uses a JNDI Lookup pattern can cause a denial of service (DoS) attack against the logging component.Source: lists.debian.org

Am I affected, and how do I check?

Affected log4j-core ranges include versions from 0 up to 2.3.1, 2.4.0 up to 2.12.2, and 2.13.0 up to 2.16.0, plus several pax-logging-log4j2 ranges (1.8.0 to 1.9.2, 1.10.0 to 1.10.8, 1.11.0 to 1.11.11, and 2.0.0 to 2.0.12). The issue applies only when the logging configuration uses a non-default Pattern Layout with a Context Lookup or a Thread Context Map pattern (%X, %mdc, or %MDC), so check the log4j-core version in the project's dependencies and the pattern layout in the logging configuration.Source: lists.debian.org

What should I do about it?

Upgrade log4j-core to 2.16.0 or later. For pax-logging-log4j2, upgrade to the fixed version for the affected branch (1.9.2, 1.10.8, 1.11.11, or 2.0.12). Debian packages carry the fix as 2.16.0-1~deb11u1.Source: lists.debian.org

Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-05-01, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data

Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack