Log4j vulnerabilities
The newest vulnerabilities affecting Log4j, up to 200. Subscribe by RSS.
- CVE-2026-85656OS command injection in Amazon log4j-cve-2021-44228-hotpatchAmazon log4j-cve-2021-44228-hotpatch
- CVE-2026-34480Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden charactersApache Software Foundation Apache Log4j Core · org.apache.l…
- CVE-2026-34479Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden charactersApache Software Foundation Apache Log4j 1 to Log4j 2 bridge…
- CVE-2026-34478Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibilityApache Software Foundation Apache Log4j Core · org.apache.l…
- CVE-2026-34477Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypassApache Software Foundation Apache Log4j Core · org.apache.l…
- CVE-2025-68161Apache Log4j Core: Missing TLS hostname verification in Socket appenderApache Software Foundation Apache Log4j Core · org.apache.l…
- CVE-2023-26464Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppenderApache Software Foundation Apache Log4j · org.apache.log… +1
- CVE-2022-0070Log4j hot patch package privilege escalationAmazon Web Services log4j-cve-2021-44228-hotpatch
- CVE-2021-3100Log4j hot patch package privilege escalationAmazon Web Services log4j-cve-2021-44228-hotpatch
- CVE-2022-23307A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.Apache Software Foundation Apache Log4j 1.x · log4j:log4j +1
- CVE-2022-23305SQL injection in JDBC Appender in Apache Log4j V1Apache Software Foundation Apache Log4j 1.x · log4j:log4j +1
- CVE-2022-23302Deserialization of untrusted data in JMSSink in Apache Log4j 1.xApache Software Foundation Apache Log4j 1.x · log4j:log4j +1
- CVE-2021-44832Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configurationApache Software Foundation Apache Log4j2 · org.apache.lo… +1
- CVE-2021-45105Apache Log4j2 does not always protect from infinite recursion in lookup evaluationApache Software Foundation Apache Log4j2 · org.apache.lo… +1
- CVE-2021-45046Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attackApache Software Foundation Apache Log4j · org.apache.log… +1
- CVE-2021-4104Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2Apache Software Foundation Apache Log4j 1.x · log4j:log4j +1
- CVE-2021-44228Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpointsApache Software Foundation Apache Log4j2 · org.apache.lo… +4
- CVE-2020-9488Improper validation of certificate with host mismatch in Apache Log4j SMTP appender.Apache Log4j · org.apache.logging.log4j:log4j +1
- CVE-2019-17571Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely exeApache Software Foundation Log4j · log4j:log4j +1
- CVE-2017-5645In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another applicApache Software Foundation Apache Log4j · org.apache.log… +1