# cve.now: Log4j

The newest entries affecting Log4j (up to 200). Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-85656](https://cve.now/CVE-2026-85656.md): OS command injection in Amazon log4j-cve-2021-44228-hotpatch (CVSS 8.5, Amazon log4j-cve-2021-44228-hotpatch)
- [CVE-2026-34480](https://cve.now/CVE-2026-34480.md): Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters (CVSS 6.9, Apache Software Foundation Apache Log4j Core · org.apache.l…)
- [CVE-2026-34479](https://cve.now/CVE-2026-34479.md): Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters (CVSS 6.9, Apache Software Foundation Apache Log4j 1 to Log4j 2 bridge…)
- [CVE-2026-34478](https://cve.now/CVE-2026-34478.md): Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility (CVSS 6.9, Apache Software Foundation Apache Log4j Core · org.apache.l…)
- [CVE-2026-34477](https://cve.now/CVE-2026-34477.md): Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass (CVSS 6.3, Apache Software Foundation Apache Log4j Core · org.apache.l…)
- [CVE-2025-68161](https://cve.now/CVE-2025-68161.md): Apache Log4j Core: Missing TLS hostname verification in Socket appender (CVSS 6.3, Apache Software Foundation Apache Log4j Core · org.apache.l…)
- [CVE-2023-26464](https://cve.now/CVE-2023-26464.md): Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender (CVSS 7.5, Apache Software Foundation Apache Log4j · org.apache.log… +1)
- [CVE-2022-0070](https://cve.now/CVE-2022-0070.md): Log4j hot patch package privilege escalation (CVSS 8.8, Amazon Web Services log4j-cve-2021-44228-hotpatch)
- [CVE-2021-3100](https://cve.now/CVE-2021-3100.md): Log4j hot patch package privilege escalation (CVSS 8.8, Amazon Web Services log4j-cve-2021-44228-hotpatch)
- [CVE-2022-23307](https://cve.now/CVE-2022-23307.md): A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution. (CVSS 8.8, Apache Software Foundation Apache Log4j 1.x · log4j:log4j +1)
- [CVE-2022-23305](https://cve.now/CVE-2022-23305.md): SQL injection in JDBC Appender in Apache Log4j V1 (CVSS 9.8, Apache Software Foundation Apache Log4j 1.x · log4j:log4j +1)
- [CVE-2022-23302](https://cve.now/CVE-2022-23302.md): Deserialization of untrusted data in JMSSink in Apache Log4j 1.x (CVSS 8.8, Apache Software Foundation Apache Log4j 1.x · log4j:log4j +1)
- [CVE-2021-44832](https://cve.now/CVE-2021-44832.md): Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration (CVSS 6.6, Apache Software Foundation Apache Log4j2 · org.apache.lo… +1)
- [CVE-2021-45105](https://cve.now/CVE-2021-45105.md): Apache Log4j2 does not always protect from infinite recursion in lookup evaluation (CVSS 5.9, Apache Software Foundation Apache Log4j2 · org.apache.lo… +1)
- [CVE-2021-45046](https://cve.now/CVE-2021-45046.md): Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack (CVSS 9.0, KEV, Apache Software Foundation Apache Log4j · org.apache.log… +1)
- [CVE-2021-4104](https://cve.now/CVE-2021-4104.md): Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 (CVSS 7.5, Apache Software Foundation Apache Log4j 1.x · log4j:log4j +1)
- [CVE-2021-44228](https://cve.now/CVE-2021-44228.md): Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints (CVSS 10.0, KEV, Apache Software Foundation Apache Log4j2 · org.apache.lo… +4)
- [CVE-2020-9488](https://cve.now/CVE-2020-9488.md): Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. (CVSS 3.7, Apache Log4j · org.apache.logging.log4j:log4j +1)
- [CVE-2019-17571](https://cve.now/CVE-2019-17571.md): Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely exe (CVSS 9.8, Apache Software Foundation Log4j · log4j:log4j +1)
- [CVE-2017-5645](https://cve.now/CVE-2017-5645.md): In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another applic (no CVSS, Apache Software Foundation Apache Log4j · org.apache.log… +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/tech/log4j
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.