Skip to main content
← Maven

org.apache.logging.log4j:log4j

2 known vulnerabilities (1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
2 · 1 low
Registry
Maven Central

Advisories 2

  • Improper validation of certificate with host mismatch in Apache Log4j SMTP appender.

    Affected: from 2.13.0, fixed in 2.13.2; from 2.4.0, fixed in 2.12.3; fixed in 2.3.2.

  • In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another applic

    Affected: from 2.0, fixed in 2.8.2.