# org.ops4j.pax.logging:pax-logging-log4j2 (Maven) vulnerabilities 4 known vulnerabilities (2 critical, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2.3.5 (Aug 11, 2026): no advisory affects it - Newest unaffected release: 2.3.5 (Aug 11, 2026), the latest release - Dependents: 32 - Releases: 105 since 1.8.0 (Oct 14, 2014) - Registry: https://central.sonatype.com/artifact/org.ops4j.pax.logging/pax-logging-log4j2 - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2021-44832: 1.8.0 to 1.9.1 (1.9.2 is outside it); 1.10.0 to 1.10.8 (1.10.9 is outside it); 1.11.0 to 1.11.12 (1.11.13 is outside it); 2.0.0 to 2.0.13 (2.0.14 is outside it) - CVE-2021-45105: 1.8.0 to 1.9.1 (1.9.2 is outside it); 1.10.0 to 1.10.8 (1.10.9 is outside it); 1.11.0 to 1.11.11 (1.11.12 is outside it); 2.0.0 to 2.0.12 (2.0.13 is outside it) - CVE-2021-45046: 1.8.0 to 1.9.1 (1.9.2 is outside it); 1.10.0 to 1.10.7 (1.10.8 is outside it); 1.11.0 to 1.11.10 (1.11.11 is outside it); 2.0.0 to 2.0.11 (2.0.12 is outside it) - CVE-2021-44228: 1.8.0 to 1.9.1 (1.9.2 is outside it); 1.10.0 to 1.10.7 (1.10.8 is outside it); 1.11.0 to 1.11.9 (1.11.10 is outside it); 2.0.0 to 2.0.10 (2.0.11 is outside it) ## Advisories (4) ### [CVE-2021-44832](https://cve.now/CVE-2021-44832): Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration - Severity: Medium 6.6 - Published: Dec 28, 2021 - Affected: from 1.8.0, fixed in 1.9.2; from 1.10.0, fixed in 1.10.9; from 1.11.0, fixed in 1.11.13; from 2.0.0, fixed in 2.0.14. - Fixed in 1.9.2 (released Jan 31, 2022, 34 days after disclosure), 1.10.9 (released Dec 30, 2021, 2 days after disclosure), 1.11.13 (released Dec 30, 2021, 2 days after disclosure) and 1 other version. - The latest release, 2.3.5, is not affected. ### [CVE-2021-45105](https://cve.now/CVE-2021-45105): Apache Log4j2 does not always protect from infinite recursion in lookup evaluation - Severity: Medium 5.9 - Published: Dec 18, 2021 - Affected: from 1.8.0, fixed in 1.9.2; from 1.10.0, fixed in 1.10.9; from 1.11.0, fixed in 1.11.12; from 2.0.0, fixed in 2.0.13. - Fixed in 1.9.2 (released Jan 31, 2022, 44 days after disclosure), 1.10.9 (released Dec 30, 2021, 12 days after disclosure), 1.11.12 (released Dec 19, 2021, 1 day after disclosure) and 1 other version. - The latest release, 2.3.5, is not affected. ### [CVE-2021-45046](https://cve.now/CVE-2021-45046): Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack - Severity: Critical 9.0 · KEV - Published: Dec 14, 2021 - Affected: from 1.8.0, fixed in 1.9.2; from 1.10.0, fixed in 1.10.8; from 1.11.0, fixed in 1.11.11; from 2.0.0, fixed in 2.0.12. - Fixed in 1.9.2 (released Jan 31, 2022, 48 days after disclosure), 1.10.8 (released Dec 19, 2021, 5 days after disclosure), 1.11.11 (released Dec 14, 2021, the day of disclosure) and 1 other version. - The latest release, 2.3.5, is not affected. ### [CVE-2021-44228](https://cve.now/CVE-2021-44228): Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints - Severity: Critical 10.0 · KEV - Published: Dec 10, 2021 - Affected: from 1.8.0, fixed in 1.9.2; from 1.10.0, fixed in 1.10.8; from 1.11.0, fixed in 1.11.10; from 2.0.0, fixed in 2.0.11. - Fixed in 1.9.2 (released Jan 31, 2022, 52 days after disclosure), 1.10.8 (released Dec 19, 2021, 9 days after disclosure), 1.11.10 (released Dec 10, 2021, the day of disclosure) and 1 other version. - The latest release, 2.3.5, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.ops4j.pax.logging:pax-logging-log4j2 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.