# org.apache.logging.log4j:log4j-core (Maven) vulnerabilities 12 known vulnerabilities (2 critical, 1 high, 7 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.26.1 (Jun 29, 2026): no advisory affects it - Newest unaffected release: 2.26.1 (Jun 29, 2026), the latest release - Dependents: 241 - Releases: 78 since 2.0 (Jul 12, 2014) - Registry: https://central.sonatype.com/artifact/org.apache.logging.log4j/log4j-core - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-34480: 2.0-alpha1 to 2.25.3 (2.25.4 is outside it); 3.0.0-alpha1 to 3.0.0-beta3 (through the newest release) - CVE-2026-34479: 2.7 to 2.25.3 (2.25.4 is outside it); 3.0.0-beta1 to 3.0.0-beta2 (3.0.0-beta3 is outside it) - CVE-2026-34478: 2.21.0 to 2.25.3 (2.25.4 is outside it); 3.0.0-beta1 to 3.0.0-beta3 (through the newest release) - CVE-2026-34477: 2.12.0 to 2.25.3 (2.25.4 is outside it); 3.0.0-alpha1 to 3.0.0-beta3 (through the newest release) - CVE-2025-68161: 2.0-beta9 to 2.25.2 (2.25.3 is outside it); 3.0.0-alpha1 to 3.0.0-beta3 (through the newest release) - CVE-2023-26464: 2.0-alpha1 to 2.0-rc2 (2.0 is outside it) - CVE-2021-44832: 2.0-beta7 to 2.3.1 (2.3.2 is outside it); 2.4 to 2.12.3 (2.12.4 is outside it); 2.13.0 to 2.17.0 (2.17.1 is outside it) - CVE-2021-45105: 2.0-alpha1 to 2.3 (2.3.1 is outside it); 2.4 to 2.12.2 (2.12.3 is outside it); 2.13.0 to 2.16.0 (2.17.0 is outside it) - CVE-2021-45046: 2.0-alpha1 to 2.3 (2.3.1 is outside it); 2.4 to 2.12.1 (2.12.2 is outside it); 2.13.0 to 2.15.0 (2.16.0 is outside it) - CVE-2021-44228: 2.0-beta9 to 2.3 (2.3.1 is outside it); 2.4 to 2.12.1 (2.12.2 is outside it); 2.13.0 to 2.14.1 (2.15.0 is outside it) - CVE-2020-9488: 2.0-alpha1 to 2.3.1 (2.3.2 is outside it); 2.4 to 2.12.2 (2.12.3 is outside it); 2.13.0 to 2.13.1 (2.13.2 is outside it) - CVE-2017-5645: 2.0 to 2.8.1 (2.8.2 is outside it) ## Advisories (12) ### [CVE-2026-34480](https://cve.now/CVE-2026-34480): Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters - Severity: Medium 6.9 - Published: Apr 10, 2026 - Affected: from 2.0-alpha1, fixed in 2.25.4; from 3.0.0-alpha1, through 3.0.0-beta3; from 2.0-alpha1, fixed in 2.25.4; from 3.0.0-alpha1, through 3.0.0-beta3. - Fixed in 2.25.4 (released Mar 25, 2026, 16 days before disclosure). - The latest release, 2.26.1, is not affected. ### [CVE-2026-34479](https://cve.now/CVE-2026-34479): Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters - Severity: Medium 6.9 - Published: Apr 10, 2026 - Affected: from 2.7, fixed in 2.25.4; from 3.0.0-beta1, through 3.0.0-beta2. - Fixed in 2.25.4 (released Mar 25, 2026, 16 days before disclosure). - The latest release, 2.26.1, is not affected. ### [CVE-2026-34478](https://cve.now/CVE-2026-34478): Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility - Severity: Medium 6.9 - Published: Apr 10, 2026 - Affected: from 2.21.0, fixed in 2.25.4; from 3.0.0-beta1, through 3.0.0-beta3; from 2.21.0, fixed in 2.25.4; from 3.0.0-beta1, through 3.0.0-beta3. - Fixed in 2.25.4 (released Mar 25, 2026, 16 days before disclosure). - The latest release, 2.26.1, is not affected. ### [CVE-2026-34477](https://cve.now/CVE-2026-34477): Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass - Severity: Medium 6.3 - Published: Apr 10, 2026 - Affected: from 2.12.0, fixed in 2.25.4; from 3.0.0-alpha1, through 3.0.0-beta3; from 2.12.0, fixed in 2.25.4; from 3.0.0-alpha1, through 3.0.0-beta3. - Fixed in 2.25.4 (released Mar 25, 2026, 16 days before disclosure). - The latest release, 2.26.1, is not affected. ### [CVE-2025-68161](https://cve.now/CVE-2025-68161): Apache Log4j Core: Missing TLS hostname verification in Socket appender - Severity: Medium 6.3 - Published: Dec 18, 2025 - Affected: from 2.0-beta9, fixed in 2.25.3; from 3.0.0-alpha1, through 3.0.0-beta3; from 2.0-beta9, fixed in 2.25.3. - Fixed in 2.25.3 (released Dec 15, 2025, 3 days before disclosure). - The latest release, 2.26.1, is not affected. ### [CVE-2023-26464](https://cve.now/CVE-2023-26464): Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender - Severity: High 7.5 - Published: Mar 10, 2023 - Affected: from 1.0.4, fixed in 2.0. - Fixed in 2.0 (released Jul 12, 2014, 3163 days before disclosure). - The latest release, 2.26.1, is not affected. ### [CVE-2021-44832](https://cve.now/CVE-2021-44832): Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration - Severity: Medium 6.6 - Published: Dec 28, 2021 - Affected: from 2.0-beta7, fixed in 2.3.2; from 2.4, fixed in 2.12.4; from 2.13.0, fixed in 2.17.1. - Fixed in 2.3.2 (released Dec 29, 2021, 1 day after disclosure), 2.12.4 (released Dec 28, 2021, the day of disclosure) and 2.17.1 (released Dec 27, 2021, 1 day before disclosure). - The latest release, 2.26.1, is not affected. ### [CVE-2021-45105](https://cve.now/CVE-2021-45105): Apache Log4j2 does not always protect from infinite recursion in lookup evaluation - Severity: Medium 5.9 - Published: Dec 18, 2021 - Affected: from 2.4.0, fixed in 2.12.3; from 2.13.0, fixed in 2.17.0; fixed in 2.3.1. - Fixed in 2.3.1 (released Dec 21, 2021, 3 days after disclosure), 2.12.3 (released Dec 20, 2021, 2 days after disclosure) and 2.17.0 (released Dec 18, 2021, the day of disclosure). - The latest release, 2.26.1, is not affected. ### [CVE-2021-45046](https://cve.now/CVE-2021-45046): Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack - Severity: Critical 9.0 · KEV - Published: Dec 14, 2021 - Affected: from 2.13.0, fixed in 2.16.0; from 2.4.0, fixed in 2.12.2; fixed in 2.3.1. - Fixed in 2.3.1 (released Dec 21, 2021, 7 days after disclosure), 2.12.2 (released Dec 14, 2021, the day of disclosure) and 2.16.0 (released Dec 13, 2021, 1 day before disclosure). - The latest release, 2.26.1, is not affected. ### [CVE-2021-44228](https://cve.now/CVE-2021-44228): Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints - Severity: Critical 10.0 · KEV - Published: Dec 10, 2021 - Affected: from 2.13.0, fixed in 2.15.0; from 2.0-beta9, fixed in 2.3.1; from 2.4, fixed in 2.12.2. - Fixed in 2.3.1 (released Dec 21, 2021, 11 days after disclosure), 2.12.2 (released Dec 14, 2021, 4 days after disclosure) and 2.15.0 (released Dec 9, 2021, 1 day before disclosure). - The latest release, 2.26.1, is not affected. ### [CVE-2020-9488](https://cve.now/CVE-2020-9488): Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. - Severity: Low 3.7 - Published: Apr 27, 2020 - Affected: from 2.13.0, fixed in 2.13.2; from 2.4.0, fixed in 2.12.3; fixed in 2.3.2. - Fixed in 2.3.2 (released Dec 29, 2021, 611 days after disclosure), 2.12.3 (released Dec 20, 2021, 602 days after disclosure) and 2.13.2 (released Apr 21, 2020, 6 days before disclosure). - The latest release, 2.26.1, is not affected. ### [CVE-2017-5645](https://cve.now/CVE-2017-5645): In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another applic - Severity: Unrated - Published: Apr 17, 2017 - Affected: from 2.0, fixed in 2.8.2. - Fixed in 2.8.2 (released Apr 2, 2017, 15 days before disclosure). - The latest release, 2.26.1, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.apache.logging.log4j:log4j-core Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.