Log4j (Apache) - vulnerabilities (CVEs)

20 CVEs, 0 in the last 30 days, 164 known versions, newest CVE from 2026-07-10. Vendor: Apache.

CVEs of Log4j

CVE-2026-49844 - CVSS 6.3 (medium), 2026-07-10: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This…
CVE-2026-34478 - CVSS 7.5 (high), 2026-04-10: Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to…
CVE-2026-34481 - CVSS 7.5 (high), 2026-04-10: Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces…
CVE-2026-34480 - CVSS 7.5 (high), 2026-04-10: Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize…
CVE-2026-34479 - CVSS 7.5 (high), 2026-04-10: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output.…
CVE-2026-34477 - CVSS 6.3 (medium), 2026-04-10: The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via…
CVE-2025-68161 - CVSS 6.3 (medium), 2025-12-18: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the…
CVE-2023-26464 - CVSS 7.5 (high), 2023-03-10: ** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a…
CVE-2022-23302 - CVSS 8.8 (high), 2022-01-18: JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if…
CVE-2022-23307 - CVSS 8.8 (high), 2022-01-18: CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x…
CVE-2022-23305 - CVSS 9.8 (critical), 2022-01-18: By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from…
CVE-2021-44832 - CVSS 6.6 (medium), 2021-12-28: Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when…
CVE-2021-45105 - CVSS 5.9 (medium), 2021-12-18: Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This…
CVE-2021-45046 - CVSS 9 (critical), 2021-12-14: It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers…
CVE-2021-4104 - CVSS 7.5 (high), 2021-12-14: JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can…
CVE-2021-44228 - CVSS 10 (critical), 2021-12-10: Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and…
CVE-2020-9493 - CVSS 9.8 (critical), 2021-06-16: A deserialization flaw was found in Apache Chainsaw versions prior to 2.1.0 which could lead to malicious code execution.
CVE-2020-9488 - CVSS 3.7 (low), 2020-04-27: Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a…
CVE-2019-17571 - CVSS 9.8 (critical), 2019-12-20: Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary…
CVE-2017-5645 - CVSS 9.8 (critical), 2017-04-17: In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially…