Actively exploited in the wild
Apache Log4j2 Deserialization of Untrusted Data Vulnerability
Apache - Log4j2 · Listed in the CISA KEV since 2023-05-01. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-45046
CriticalCVSS 9.0KEVSummary
The fix for CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. Attackers with control over Thread Context Map (MDC) input data when using a non-default Pattern Layout with Context Lookup (e.g., $${ctx:loginId}) or Thread Context Map pattern (%X, %mdc, %MDC) can craft malicious input using a JNDI Lookup pattern, leading to information leak and remote code execution in some environments and local code execution in all environments.
Risk Assessment
Potential remote code execution on the application server, which can lead to full system compromise, data theft, or malware installation. Affects environments using Log4j 2.15.0 in non-default configurations.
Recommendation
Upgrade Log4j to 2.16.0 (Java 8) or 2.12.2 (Java 7), which remove support for message lookup patterns and disable JNDI by default. If upgrade is not possible, apply vendor-recommended workarounds.
Other vulnerabilities in Apache Log4j
See all- CVE-2017-5645Critical
In Apache Log4j 2.x before version 2.8.2, when using the TCP socket server or UDP socket server to receive log events, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
- CVE-2026-34481High
Apache Log4j JsonTemplateLayout up to version 2.25.3 produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, -Infinity), which violates RFC 8259. An attacker can exploit this if the application uses JsonTemplateLayout and logs a MapMessage or an object with a controlled floating-point value.
Original NVD description (English source)
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.