Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.logging.log4j:log4j-core

12 known vulnerabilities (2 critical, 1 high, 7 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
2.26.1 (Jun 29, 2026): no advisory affects it
Newest unaffected release
2.26.1 (Jun 29, 2026), the latest release
Advisories
12 · 2 critical, 1 high, 7 medium, 1 low
Dependents
241
Releases
78 since 2.0 (Jul 12, 2014)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-34480
    Affects 2.0-alpha1 to 2.25.3 (2.25.4 is outside it); 3.0.0-alpha1 to 3.0.0-beta3 (through the newest release)
  • CVE-2026-34479
    Affects 2.7 to 2.25.3 (2.25.4 is outside it); 3.0.0-beta1 to 3.0.0-beta2 (3.0.0-beta3 is outside it)
  • CVE-2026-34478
    Affects 2.21.0 to 2.25.3 (2.25.4 is outside it); 3.0.0-beta1 to 3.0.0-beta3 (through the newest release)
  • CVE-2026-34477
    Affects 2.12.0 to 2.25.3 (2.25.4 is outside it); 3.0.0-alpha1 to 3.0.0-beta3 (through the newest release)
  • CVE-2025-68161
    Affects 2.0-beta9 to 2.25.2 (2.25.3 is outside it); 3.0.0-alpha1 to 3.0.0-beta3 (through the newest release)
  • CVE-2023-26464
    Affects 2.0-alpha1 to 2.0-rc2 (2.0 is outside it)
  • CVE-2021-44832
    Affects 2.0-beta7 to 2.3.1 (2.3.2 is outside it); 2.4 to 2.12.3 (2.12.4 is outside it); 2.13.0 to 2.17.0 (2.17.1 is outside it)
  • CVE-2021-45105
    Affects 2.0-alpha1 to 2.3 (2.3.1 is outside it); 2.4 to 2.12.2 (2.12.3 is outside it); 2.13.0 to 2.16.0 (2.17.0 is outside it)
  • CVE-2021-45046
    Affects 2.0-alpha1 to 2.3 (2.3.1 is outside it); 2.4 to 2.12.1 (2.12.2 is outside it); 2.13.0 to 2.15.0 (2.16.0 is outside it)
  • CVE-2021-44228
    Affects 2.0-beta9 to 2.3 (2.3.1 is outside it); 2.4 to 2.12.1 (2.12.2 is outside it); 2.13.0 to 2.14.1 (2.15.0 is outside it)
  • CVE-2020-9488
    Affects 2.0-alpha1 to 2.3.1 (2.3.2 is outside it); 2.4 to 2.12.2 (2.12.3 is outside it); 2.13.0 to 2.13.1 (2.13.2 is outside it)
  • CVE-2017-5645
    Affects 2.0 to 2.8.1 (2.8.2 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 12

  • CVE-2026-34480Medium 6.9

    Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters

    Affected: from 2.0-alpha1, fixed in 2.25.4; from 3.0.0-alpha1, through 3.0.0-beta3; from 2.0-alpha1, fixed in 2.25.4; from 3.0.0-alpha1, through 3.0.0-beta3.

    Fixed in 2.25.4 (released Mar 25, 2026, 16 days before disclosure).

    The latest release, 2.26.1, is not affected.

  • CVE-2026-34479Medium 6.9

    Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters

    Affected: from 2.7, fixed in 2.25.4; from 3.0.0-beta1, through 3.0.0-beta2.

    Fixed in 2.25.4 (released Mar 25, 2026, 16 days before disclosure).

    The latest release, 2.26.1, is not affected.

  • CVE-2026-34478Medium 6.9

    Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility

    Affected: from 2.21.0, fixed in 2.25.4; from 3.0.0-beta1, through 3.0.0-beta3; from 2.21.0, fixed in 2.25.4; from 3.0.0-beta1, through 3.0.0-beta3.

    Fixed in 2.25.4 (released Mar 25, 2026, 16 days before disclosure).

    The latest release, 2.26.1, is not affected.

  • CVE-2026-34477Medium 6.3

    Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass

    Affected: from 2.12.0, fixed in 2.25.4; from 3.0.0-alpha1, through 3.0.0-beta3; from 2.12.0, fixed in 2.25.4; from 3.0.0-alpha1, through 3.0.0-beta3.

    Fixed in 2.25.4 (released Mar 25, 2026, 16 days before disclosure).

    The latest release, 2.26.1, is not affected.

  • CVE-2025-68161Medium 6.3

    Apache Log4j Core: Missing TLS hostname verification in Socket appender

    Affected: from 2.0-beta9, fixed in 2.25.3; from 3.0.0-alpha1, through 3.0.0-beta3; from 2.0-beta9, fixed in 2.25.3.

    Fixed in 2.25.3 (released Dec 15, 2025, 3 days before disclosure).

    The latest release, 2.26.1, is not affected.

  • Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender

    Affected: from 1.0.4, fixed in 2.0.

    Fixed in 2.0 (released Jul 12, 2014, 3163 days before disclosure).

    The latest release, 2.26.1, is not affected.

  • CVE-2021-44832Medium 6.6

    Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration

    Affected: from 2.0-beta7, fixed in 2.3.2; from 2.4, fixed in 2.12.4; from 2.13.0, fixed in 2.17.1.

    Fixed in 2.3.2 (released Dec 29, 2021, 1 day after disclosure), 2.12.4 (released Dec 28, 2021, the day of disclosure) and 2.17.1 (released Dec 27, 2021, 1 day before disclosure).

    The latest release, 2.26.1, is not affected.

  • CVE-2021-45105Medium 5.9

    Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

    Affected: from 2.4.0, fixed in 2.12.3; from 2.13.0, fixed in 2.17.0; fixed in 2.3.1.

    Fixed in 2.3.1 (released Dec 21, 2021, 3 days after disclosure), 2.12.3 (released Dec 20, 2021, 2 days after disclosure) and 2.17.0 (released Dec 18, 2021, the day of disclosure).

    The latest release, 2.26.1, is not affected.

  • CVE-2021-45046Critical 9.0 · KEV

    Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

    Affected: from 2.13.0, fixed in 2.16.0; from 2.4.0, fixed in 2.12.2; fixed in 2.3.1.

    Fixed in 2.3.1 (released Dec 21, 2021, 7 days after disclosure), 2.12.2 (released Dec 14, 2021, the day of disclosure) and 2.16.0 (released Dec 13, 2021, 1 day before disclosure).

    The latest release, 2.26.1, is not affected.

  • CVE-2021-44228Critical 10.0 · KEV

    Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

    Affected: from 2.13.0, fixed in 2.15.0; from 2.0-beta9, fixed in 2.3.1; from 2.4, fixed in 2.12.2.

    Fixed in 2.3.1 (released Dec 21, 2021, 11 days after disclosure), 2.12.2 (released Dec 14, 2021, 4 days after disclosure) and 2.15.0 (released Dec 9, 2021, 1 day before disclosure).

    The latest release, 2.26.1, is not affected.

  • Improper validation of certificate with host mismatch in Apache Log4j SMTP appender.

    Affected: from 2.13.0, fixed in 2.13.2; from 2.4.0, fixed in 2.12.3; fixed in 2.3.2.

    Fixed in 2.3.2 (released Dec 29, 2021, 611 days after disclosure), 2.12.3 (released Dec 20, 2021, 602 days after disclosure) and 2.13.2 (released Apr 21, 2020, 6 days before disclosure).

    The latest release, 2.26.1, is not affected.

  • In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another applic

    Affected: from 2.0, fixed in 2.8.2.

    Fixed in 2.8.2 (released Apr 2, 2017, 15 days before disclosure).

    The latest release, 2.26.1, is not affected.