MavenPackage

org.ops4j.pax.logging:pax-logging-log4j2

4 known vulnerabilities (2 critical, 2 medium), with the versions each affects and the releases that fix them.

Latest release: 2.3.5 (Aug 11, 2026): no advisory affects it
Newest unaffected release: 2.3.5 (Aug 11, 2026), the latest release
Advisories: 4 · 2 critical, 2 medium

Dependents: 32
Releases: 105 since 1.8.0 (Oct 14, 2014)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2021-44832
Affects 1.8.0 to 1.9.1 (1.9.2 is outside it); 1.10.0 to 1.10.8 (1.10.9 is outside it); 1.11.0 to 1.11.12 (1.11.13 is outside it); 2.0.0 to 2.0.13 (2.0.14 is outside it)
CVE-2021-45105
Affects 1.8.0 to 1.9.1 (1.9.2 is outside it); 1.10.0 to 1.10.8 (1.10.9 is outside it); 1.11.0 to 1.11.11 (1.11.12 is outside it); 2.0.0 to 2.0.12 (2.0.13 is outside it)
CVE-2021-45046
Affects 1.8.0 to 1.9.1 (1.9.2 is outside it); 1.10.0 to 1.10.7 (1.10.8 is outside it); 1.11.0 to 1.11.10 (1.11.11 is outside it); 2.0.0 to 2.0.11 (2.0.12 is outside it)
CVE-2021-44228
Affects 1.8.0 to 1.9.1 (1.9.2 is outside it); 1.10.0 to 1.10.7 (1.10.8 is outside it); 1.11.0 to 1.11.9 (1.11.10 is outside it); 2.0.0 to 2.0.10 (2.0.11 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 4

CVE-2021-44832Medium 6.6
Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration
Affected: from 1.8.0, fixed in 1.9.2; from 1.10.0, fixed in 1.10.9; from 1.11.0, fixed in 1.11.13; from 2.0.0, fixed in 2.0.14.
Fixed in 1.9.2 (released Jan 31, 2022, 34 days after disclosure), 1.10.9 (released Dec 30, 2021, 2 days after disclosure), 1.11.13 (released Dec 30, 2021, 2 days after disclosure) and 1 other version.
The latest release, 2.3.5, is not affected.
CVE-2021-45105Medium 5.9
Apache Log4j2 does not always protect from infinite recursion in lookup evaluation
Affected: from 1.8.0, fixed in 1.9.2; from 1.10.0, fixed in 1.10.9; from 1.11.0, fixed in 1.11.12; from 2.0.0, fixed in 2.0.13.
Fixed in 1.9.2 (released Jan 31, 2022, 44 days after disclosure), 1.10.9 (released Dec 30, 2021, 12 days after disclosure), 1.11.12 (released Dec 19, 2021, 1 day after disclosure) and 1 other version.
The latest release, 2.3.5, is not affected.
CVE-2021-45046Critical 9.0 · KEV
Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
Affected: from 1.8.0, fixed in 1.9.2; from 1.10.0, fixed in 1.10.8; from 1.11.0, fixed in 1.11.11; from 2.0.0, fixed in 2.0.12.
Fixed in 1.9.2 (released Jan 31, 2022, 48 days after disclosure), 1.10.8 (released Dec 19, 2021, 5 days after disclosure), 1.11.11 (released Dec 14, 2021, the day of disclosure) and 1 other version.
The latest release, 2.3.5, is not affected.
CVE-2021-44228Critical 10.0 · KEV
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
Affected: from 1.8.0, fixed in 1.9.2; from 1.10.0, fixed in 1.10.8; from 1.11.0, fixed in 1.11.10; from 2.0.0, fixed in 2.0.11.
Fixed in 1.9.2 (released Jan 31, 2022, 52 days after disclosure), 1.10.8 (released Dec 19, 2021, 9 days after disclosure), 1.11.10 (released Dec 10, 2021, the day of disclosure) and 1 other version.
The latest release, 2.3.5, is not affected.