{"id":"CVE-2025-68161","aliases":["CLSA-2026-1779842948","CLSA-2026-1781052749","CLSA-2026-1784683011","CLSA-2026-1784769542","CLSA-2026-1785727932","CLSA-2026-1790944047","CLSA-2026-1791375236","CLSA-2026-1791900475","CLSA-2026-1792696729","CLSA-2026-1793052872","CLSA-2026-1793354113","DEBIAN-CVE-2025-68161","DLA-4444-1","EUVD-2025-204312","GHSA-3pxv-7cmr-fjr4","GHSA-445c-vh5m-36rj","GHSA-6hg6-v5c8-fphq","GHSA-vc5p-v9hr-52mj","RHLW-2026-64cfac683d7a9af7","RHLW-2026-97a6348484d7bbf1","ROOT-APP-MAVEN-CVE-2025-68161","SUSE-SU-2026:0254-1","UBUNTU-CVE-2025-68161","openSUSE-SU-2026:10009-1","openSUSE-SU-2026:20099-1"],"status":"published","title":"Apache Log4j Core: Missing TLS hostname verification in Socket appender","description":"The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the  verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName  configuration attribute or the  log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName  system property is set to true.\n\nThis issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:\n\n  *  The attacker is able to intercept or redirect network traffic between the client and the log receiver.\n  *  The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).\n\n\nUsers are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.\n\nAs an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00767,"percentile":0.55785,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295","CWE-297"],"published":"2025-12-18T20:47:49Z","modified":"2026-11-02T19:46:33Z","fixes":[{"ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","fixed_in":["2.25.3"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","fixed_in":["2.17.1-tuxcare.1","2.22.1-tuxcare.2","2.13.3-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"apache-log4j2","fixed_in":["2.17.1-1~deb11u2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.apache.logging.log4j:log4j-core","fixed_in":["2.12.4-aikido.10","2.19.0-aikido.9","2.25.0-aikido.11","2.25.0-aikido.12","2.21.1-aikido.5","2.19.0-aikido.9306","2.25.3-aikido.1","2.25.3-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.apache.logging.log4j:log4j-core","fixed_in":["2.12.4-root.io.1","2.19.0-root.io.1","2.25.0-root.io.1","2.19.0-root.io.2","2.19.0-root.io.3","2.12.4-root.io.2","2.25.0-root.io.2","2.12.4-root.io.3","2.19.0-root.io.8","2.12.4-root.io.9","2.25.0-root.io.10","2.12.4-root.io.10","2.19.0-root.io.9","2.25.0-root.io.11","2.21.1-root.io.4","2.25.0-root.io.12","2.21.1-root.io.5","2.19.0-root.io.9306","2.25.3-root.io.1","2.25.3-root.io.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"log4j","fixed_in":["2.20.0-150200.4.30.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"log4j","fixed_in":["2.20.0-150200.4.30.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"log4j","fixed_in":["2.20.0-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0-beta9"},{"fixed":"2.25.3"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.1"},{"fixed":"2.17.1-tuxcare.1"}]}],"versions":["2.17.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.22.1"},{"fixed":"2.22.1-tuxcare.2"}]}],"versions":["2.22.1","2.22.1-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.24.3"},{"fixed":"2.24.3-tuxcare.1"}]}],"versions":["2.24.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-layout-template-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.24.3"},{"fixed":"2.24.3-tuxcare.1"}]}],"versions":["2.24.3"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.0"},{"fixed":"2.18.0-tuxcare.1"}]}],"versions":["2.18.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-layout-template-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.18.0"},{"fixed":"2.18.0-tuxcare.1"}]}],"versions":["2.18.0"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.2"},{"fixed":"2.17.2-tuxcare.2"}]}],"versions":["2.17.2","2.17.2-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-layout-template-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.17.2"},{"fixed":"2.17.2-tuxcare.2"}]}],"versions":["2.17.2","2.17.2-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"fixed":"2.19.0-tuxcare.1"}]}],"versions":["2.19.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"fixed":"2.19.0-tuxcare.1"}]}],"versions":["2.19.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-layout-template-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.19.0"},{"fixed":"2.19.0-tuxcare.1"}]}],"versions":["2.19.0"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.23.1"},{"fixed":"2.23.1-tuxcare.2"}]}],"versions":["2.23.1","2.23.1-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.3"},{"fixed":"2.13.3-tuxcare.2"}]}],"versions":["2.13.3","2.13.3-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.20.0"},{"fixed":"2.20.0-tuxcare.2"}]}],"versions":["2.20.0","2.20.0-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.20.0"},{"fixed":"2.20.0-tuxcare.2"}]}],"versions":["2.20.0","2.20.0-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.20.0"},{"fixed":"2.20.0-tuxcare.2"}]}],"versions":["2.20.0","2.20.0-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-layout-template-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.20.0"},{"fixed":"2.20.0-tuxcare.2"}]}],"versions":["2.20.0","2.20.0-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.1"},{"fixed":"2.21.1-tuxcare.1"}]}],"versions":["2.21.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.1"},{"fixed":"2.21.1-tuxcare.1"}]}],"versions":["2.21.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.1"},{"fixed":"2.21.1-tuxcare.1"}]}],"versions":["2.21.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-layout-template-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.21.1"},{"fixed":"2.21.1-tuxcare.1"}]}],"versions":["2.21.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.25.2"},{"fixed":"2.25.2-tuxcare.1"}]}],"versions":["2.25.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.25.2"},{"fixed":"2.25.2-tuxcare.1"}]}],"versions":["2.25.2"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.apache.logging.log4j:log4j-layout-template-json","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.25.2"},{"fixed":"2.25.2-tuxcare.1"}]}],"versions":["2.25.2"],"bundled":5},{"source":"osv","ecosystem":"Debian:12","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.19.0-2"]},{"source":"osv","ecosystem":"Debian:13","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.19.0-2"]},{"source":"osv","ecosystem":"Debian:14","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.19.0-2"]},{"source":"osv","ecosystem":"Debian:11","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.1-1~deb11u2"}]}],"versions":["2.13.3-1","2.15.0-1","2.15.0-1~deb10u1","2.15.0-1~deb11u1","2.16.0-1","2.16.0-1~deb10u1","2.16.0-1~deb11u1","2.17.0-1","2.17.0-1~deb10u1","2.17.0-1~deb11u1","2.17.1-1~deb10u1","2.17.1-1~deb11u1"]},{"source":"osv","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0-beta9"},{"fixed":"2.25.3"}]}],"versions":["2.0","2.0-beta9","2.0-rc1","2.0-rc2","2.0.1","2.0.2","2.1","2.10.0","2.11.0","2.11.1","2.11.2","2.12.0","2.12.1","2.12.2","2.12.3","2.12.4","2.13.0","2.13.1","2.13.2","2.13.3","2.14.0","2.14.1","2.15.0","2.16.0","2.17.0","2.17.1","2.17.2","2.18.0","2.19.0","2.2","2.20.0","2.21.0","2.21.1","2.22.0","2.22.1","2.23.0","2.23.1","2.24.0","2.24.1","2.24.2","2.24.3","2.25.0","2.25.1","2.25.2","2.3","2.3.1","2.3.2","2.4","2.4.1","2.5","2.6","2.6.1","2.6.2","2.7","2.8","2.8.1","2.8.2","2.9.0","2.9.1"]},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.logging.log4j:log4j-1.2-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.3.rhlw-00004"}]}],"versions":["2.0","2.0-beta5","2.0-beta6","2.0-beta7","2.0-beta8","2.0-beta9","2.0-rc1","2.0-rc2","2.0.1","2.0.2","2.1","2.10.0","2.11.0","2.11.1","2.11.2","2.12.0","2.12.1","2.12.2","2.12.3","2.12.4","2.13.0","2.13.1","2.13.2","2.13.3","2.14.0","2.14.1","2.15.0","2.16.0","2.17.0","2.17.1","2.17.2","2.18.0","2.19.0","2.2","2.20.0","2.21.0","2.21.1","2.22.0","2.22.1","2.23.0","2.23.1","2.24.0","2.24.1","2.24.2","2.24.3","2.3","2.3.1","2.3.2","2.4","2.4.1","2.5","2.6","2.6.1","2.6.2","2.7","2.8","2.8.1","2.8.2","2.9.0","2.9.1"],"bundled":4},{"source":"osv","ecosystem":"Red Hat Lightwell:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.3.rhlw-00004"}]}],"versions":["2.0","2.0-alpha1","2.0-alpha2","2.0-beta1","2.0-beta2","2.0-beta3","2.0-beta4","2.0-beta5","2.0-beta6","2.0-beta7","2.0-beta8","2.0-beta9","2.0-rc1","2.0-rc2","2.0.1","2.0.2","2.1","2.10.0","2.11.0","2.11.1","2.11.2","2.12.0","2.12.1","2.12.2","2.12.3","2.12.4","2.13.0","2.13.1","2.13.2","2.13.3","2.14.0","2.14.1","2.15.0","2.16.0","2.17.0","2.17.1","2.17.2","2.18.0","2.19.0","2.2","2.20.0","2.21.0","2.21.1","2.22.0","2.22.1","2.23.0","2.23.1","2.24.0","2.24.1","2.24.2","2.24.3","2.3","2.3.1","2.3.2","2.4","2.4.1","2.5","2.6","2.6.1","2.6.2","2.7","2.8","2.8.1","2.8.2","2.9.0","2.9.1"],"bundled":4},{"source":"osv","ecosystem":"Root:Maven","package":"org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.4-aikido.10"},{"fixed":"2.19.0-aikido.9"},{"fixed":"2.25.0-aikido.11"},{"fixed":"2.25.0-aikido.12"},{"fixed":"2.21.1-aikido.5"},{"fixed":"2.19.0-aikido.9306"},{"fixed":"2.25.3-aikido.1"},{"fixed":"2.25.3-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.apache.logging.log4j:log4j-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.4-root.io.1"},{"fixed":"2.19.0-root.io.1"},{"fixed":"2.25.0-root.io.1"},{"fixed":"2.19.0-root.io.2"},{"fixed":"2.19.0-root.io.3"},{"fixed":"2.12.4-root.io.2"},{"fixed":"2.25.0-root.io.2"},{"fixed":"2.12.4-root.io.3"},{"fixed":"2.19.0-root.io.8"},{"fixed":"2.12.4-root.io.9"},{"fixed":"2.25.0-root.io.10"},{"fixed":"2.12.4-root.io.10"},{"fixed":"2.19.0-root.io.9"},{"fixed":"2.25.0-root.io.11"},{"fixed":"2.21.1-root.io.4"},{"fixed":"2.25.0-root.io.12"},{"fixed":"2.21.1-root.io.5"},{"fixed":"2.19.0-root.io.9306"},{"fixed":"2.25.3-root.io.1"},{"fixed":"2.25.3-root.io.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-150200.4.30.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-150200.4.30.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2-1","2.4-1","2.4-2","2.4-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.2-1","2.8.2-2","2.10.0-1","2.10.0-2","2.10.0-2ubuntu0.1","2.12.4-0ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.11.1-2","2.11.2-1","2.15.0-0.20.04.1","2.16.0-0.20.04.1","2.17.0-0.20.04.1","2.17.1-0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.13.3-1","2.15.0-1","2.16.0-1","2.17.0-1","2.17.1-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.19.0-2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.19.0-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.19.0-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"apache-log4j2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.19.0-2","2.19.0-2build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"log4j","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.20.0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"coredns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-bp160.1.1"}]}],"bundled":4}],"products":[{"vendor":"apache","product":"log4j"},{"vendor":"apache software foundation","product":"apache log4j core"}],"references":[{"url":"https://github.com/apache/logging-log4j2/pull/4002","tags":["patch","Issue Tracking","Patch","fix","web","report"]},{"url":"https://logging.apache.org/security.html#CVE-2025-68161","tags":["vendor-advisory","Exploit","Vendor Advisory","advisory","web","report"]},{"url":"https://logging.apache.org/cyclonedx/vdr.xml","tags":["vendor-advisory","Vendor Advisory","advisory","web","report"]},{"url":"https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName","tags":["related","Product","web","report"]},{"url":"https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","tags":["related","Product","web","report"]},{"url":"https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx","tags":["vendor-advisory","Mailing List","advisory","web","report"]},{"url":"http://www.openwall.com/lists/oss-security/2025/12/18/1","tags":["Mailing List","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68161","tags":["advisory"]},{"url":"https://github.com/apache/logging-log4j2/commit/3b93748497e1adbbd027fda8a5e7268ec5d0d578","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vc5p-v9hr-52mj","tags":["advisory"]},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68161.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-68161","tags":["advisory"]},{"url":"https://github.com/apache/logging-log4j2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34477.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/lkx8cl46t2bvkcwfcb2pd43ygc097lq4","tags":["advisory"]},{"url":"https://logging.apache.org/security.html#CVE-2026-34477","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34477","tags":["advisory"]},{"url":"https://github.com/apache/logging-log4j2/pull/4075","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-6hg6-v5c8-fphq","tags":["advisory"]},{"url":"https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34478.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/3k1clr2l6vkdnl4cbhjrnt1nyjvb5gwt","tags":["advisory"]},{"url":"https://logging.apache.org/security.html#CVE-2026-34478","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34478","tags":["advisory"]},{"url":"https://github.com/apache/logging-log4j2/pull/4074","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-445c-vh5m-36rj","tags":["advisory"]},{"url":"https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34480.json","tags":["advisory"]},{"url":"https://lists.apache.org/thread/5x0hcnng0chhghp6jgjdp3qmbbhfjzhb","tags":["advisory"]},{"url":"https://logging.apache.org/security.html#CVE-2026-34480","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34480","tags":["advisory"]},{"url":"https://github.com/apache/logging-log4j2/pull/4077","tags":["fix"]},{"url":"https://github.com/advisories/GHSA-3pxv-7cmr-fjr4","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20260254-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1255427","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68161","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2025-68161","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-68161","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1239294","tags":["report"]},{"url":"https://bugzilla.suse.com/1239728","tags":["report"]},{"url":"https://bugzilla.suse.com/1249389","tags":["report"]},{"url":"https://bugzilla.suse.com/1255345","tags":["report"]},{"url":"https://bugzilla.suse.com/1256411","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-51744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-68156","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-68161","title":"Apache Log4j Core: Missing TLS hostname verification in Socket appender","description":"The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the  verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName  configuration attribute or the  log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName  system property is set to true.\n\nThis issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:\n\n  *  The attacker is able to intercept or redirect network traffic between the client and the log receiver.\n  *  The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).\n\n\nUsers are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.\n\nAs an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.","status":"published","published":"2025-12-18T20:47:49.123Z","modified":"2026-04-10T16:18:50.424Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-297"],"updated_at":"2026-11-02T14:32:36.079745Z"}],"euvd":[{"id":"EUVD-2025-204312","description":"The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the  verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName  configuration attribute or the  log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName  system property is set to true.\n\nThis issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:\n\n  *  The attacker is able to intercept or redirect network traffic between the client and the log receiver.\n  *  The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).\n\n\nUsers are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.\n\nAs an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.","status":"published","published":"2025-12-18T20:47:49Z","modified":"2026-04-10T16:18:50Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:24:29.850635Z"}],"ghsa":[{"id":"GHSA-vc5p-v9hr-52mj","title":"Apache Log4j does not verify the TLS hostname in its Socket Appender","description":"The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the  [verifyHostName](https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName)  configuration attribute or the  [log4j2.sslVerifyHostName](https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName) system property is set to true.\n\nThis issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:\n\n  *  The attacker is able to intercept or redirect network traffic between the client and the log receiver.\n  *  The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).\n\n\nUsers are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.\n\nAs an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.","status":"published","published":"2025-12-18T21:31:44Z","modified":"2025-12-19T22:08:03Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-297"],"updated_at":"2026-11-02T14:39:13.204325Z"}],"nvd":[{"id":"CVE-2025-68161","description":"The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the  verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName  configuration attribute or the  log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName  system property is set to true.\n\nThis issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:\n\n  *  The attacker is able to intercept or redirect network traffic between the client and the log receiver.\n  *  The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).\n\n\nUsers are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.\n\nAs an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.","status":"published","published":"2025-12-18T21:15:57.96Z","modified":"2026-06-17T09:58:39.58Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-297","CWE-295"],"updated_at":"2026-11-02T14:11:52.309391Z"}],"osv":[{"id":"CVE-2025-68161","title":"Apache Log4j Core: Missing TLS hostname verification in Socket appender","description":"The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the  verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName  configuration attribute or the  log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName  system property is set to true.\n\nThis issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:\n\n  *  The attacker is able to intercept or redirect network traffic between the client and the log receiver.\n  *  The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).\n\n\nUsers are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.\n\nAs an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.","status":"published","published":"2025-12-18T20:47:49.123Z","modified":"2026-10-28T02:30:43.022294994Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-297"],"updated_at":"2026-11-02T15:44:52.53036Z"},{"id":"DEBIAN-CVE-2025-68161","description":"The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the  verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName  configuration attribute or the  log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName  system property is set to true.  This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:    *  The attacker is able to intercept or redirect network traffic between the client and the log receiver.   *  The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).   Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.  As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.","status":"published","published":"2025-12-18T21:15:57.96Z","modified":"2026-09-01T20:05:56.498626809Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"GHSA-vc5p-v9hr-52mj","title":"Apache Log4j does not verify the TLS hostname in its Socket Appender","description":"The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the  [verifyHostName](https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName)  configuration attribute or the  [log4j2.sslVerifyHostName](https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName) system property is set to true.\n\nThis issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:\n\n  *  The attacker is able to intercept or redirect network traffic between the client and the log receiver.\n  *  The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).\n\n\nUsers are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.\n\nAs an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.","status":"published","published":"2025-12-18T21:31:44Z","modified":"2026-09-10T03:50:32.126499218Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-297"],"updated_at":"2026-11-02T15:46:56.981655Z"},{"id":"RHLW-2026-64cfac683d7a9af7","title":"Lightwell Security Advisory: log4j-1.2-api 2.24.3.rhlw-00004","description":"Red Hat Lightwell has released org.apache.logging.log4j:log4j-1.2-api 2.24.3.rhlw-00004 with backported fixes for CVE-2025-68161, CVE-2026-34477, CVE-2026-34478, and CVE-2026-34480.\n\nCVE-2025-68161: Apache Log4j Core: Missing TLS hostname verification in Socket appender\n\nCVE-2026-34477: Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass\n\nCVE-2026-34478: Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility\n\nCVE-2026-34480: Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters\n\nThis patched artifact is a drop-in replacement for org.apache.logging.log4j:log4j-1.2-api 2.24.3 from Maven Central.","status":"published","published":"2026-10-08T19:45:56Z","modified":"2026-10-27T04:13:02.72107918Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHLW-2026-97a6348484d7bbf1","title":"Lightwell Security Advisory: log4j-core 2.24.3.rhlw-00004","description":"Red Hat Lightwell has released org.apache.logging.log4j:log4j-core 2.24.3.rhlw-00004 with backported fixes for CVE-2025-68161, CVE-2026-34477, CVE-2026-34478, and CVE-2026-34480.\n\nCVE-2025-68161: Apache Log4j Core: Missing TLS hostname verification in Socket appender\n\nCVE-2026-34477: Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass\n\nCVE-2026-34478: Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility\n\nCVE-2026-34480: Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters\n\nThis patched artifact is a drop-in replacement for org.apache.logging.log4j:log4j-core 2.24.3 from Maven Central.","status":"published","published":"2026-10-12T19:52:23Z","modified":"2026-10-27T04:13:03.483520242Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"},{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"ROOT-APP-MAVEN-CVE-2025-68161","title":"CVE-2025-68161 in org.apache.logging.log4j:log4j-core - Patched by Root","description":"Root has patched CVE-2025-68161 in the org.apache.logging.log4j:log4j-core package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-10-27T13:14:33Z","modified":"2026-10-27T14:15:04.043706356Z","cvss":[{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"UBUNTU-CVE-2025-68161","description":"The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the  verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName  configuration attribute or the  log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName  system property is set to true. This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:   *  The attacker is able to intercept or redirect network traffic between the client and the log receiver.   *  The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured). Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue. As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.","status":"published","published":"2025-12-18T21:15:00Z","modified":"2026-10-17T12:57:30.378619585Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"},{"version":"3.1","score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:52.345622Z"},{"id":"CLSA-2026-1779842948","title":"TuxCare security update for org.apache.logging.log4j:log4j-core (1 CVE)","description":"TuxCare rebuilt org.apache.logging.log4j:log4j-core to address 1 CVE. Fixed in 2.17.1-tuxcare.1.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-11-02T19:45:29.787266246Z","updated_at":"2026-11-02T20:30:18.404297Z"},{"id":"CLSA-2026-1781052749","title":"TuxCare security update for org.apache.logging.log4j:log4j-core (1 CVE)","description":"TuxCare rebuilt org.apache.logging.log4j:log4j-core to address 1 CVE. Fixed in 2.22.1-tuxcare.2.","status":"published","published":"2026-08-04T14:52:36Z","modified":"2026-11-02T19:45:34.369559586Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1784683011","title":"TuxCare security update for org.apache.logging.log4j (2 CVEs)","description":"TuxCare rebuilt 2 org.apache.logging.log4j packages to address 2 CVEs. Fixed in 2.24.3-tuxcare.1.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-11-02T19:45:43.426767174Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1784769542","title":"TuxCare security update for org.apache.logging.log4j (2 CVEs)","description":"TuxCare rebuilt 2 org.apache.logging.log4j packages to address 2 CVEs. Fixed in 2.18.0-tuxcare.1.","status":"published","published":"2026-08-04T14:52:47Z","modified":"2026-11-02T19:45:45.378719718Z","updated_at":"2026-11-02T20:30:13.950198Z"},{"id":"CLSA-2026-1785727932","title":"TuxCare security update for org.apache.logging.log4j (3 CVEs)","description":"TuxCare rebuilt 2 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.17.2-tuxcare.2.","status":"published","published":"2026-08-04T14:52:51Z","modified":"2026-11-02T19:45:49.91461624Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1790944047","title":"TuxCare security update for org.apache.logging.log4j (3 CVEs)","description":"TuxCare rebuilt 3 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.19.0-tuxcare.1.","status":"published","published":"2026-10-02T12:27:27Z","modified":"2026-11-02T19:46:26.196653528Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1791375236","title":"TuxCare security update for org.apache.logging.log4j:log4j-core (3 CVEs)","description":"TuxCare rebuilt org.apache.logging.log4j:log4j-core to address 3 CVEs. Fixed in 2.23.1-tuxcare.2.","status":"published","published":"2026-10-07T12:13:56Z","modified":"2026-11-02T19:46:26.288157628Z","updated_at":"2026-11-02T20:29:17.805906Z"},{"id":"CLSA-2026-1791900475","title":"TuxCare security update for org.apache.logging.log4j:log4j-core (1 CVE)","description":"TuxCare rebuilt org.apache.logging.log4j:log4j-core to address 1 CVE. Fixed in 2.13.3-tuxcare.2.","status":"published","published":"2026-10-13T14:07:55Z","modified":"2026-11-02T19:46:27.328647889Z","updated_at":"2026-11-02T20:29:13.152182Z"},{"id":"CLSA-2026-1792696729","title":"TuxCare security update for org.apache.logging.log4j (5 CVEs)","description":"TuxCare rebuilt 4 org.apache.logging.log4j packages to address 5 CVEs. Fixed in 2.20.0-tuxcare.2.","status":"published","published":"2026-10-22T19:18:49Z","modified":"2026-11-02T19:46:31.511807766Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793052872","title":"TuxCare security update for org.apache.logging.log4j (4 CVEs)","description":"TuxCare rebuilt 4 org.apache.logging.log4j packages to address 4 CVEs. Fixed in 2.21.1-tuxcare.1.","status":"published","published":"2026-10-26T22:14:32Z","modified":"2026-11-02T19:46:31.591611961Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793354113","title":"TuxCare security update for org.apache.logging.log4j (5 CVEs)","description":"TuxCare rebuilt 3 org.apache.logging.log4j packages to address 5 CVEs. Fixed in 2.25.2-tuxcare.1.","status":"published","published":"2026-10-30T10:55:14Z","modified":"2026-11-02T19:46:33.204047397Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"DLA-4444-1","title":"apache-log4j2 - security update","status":"published","published":"2026-01-19T00:00:00Z","modified":"2026-01-19T23:15:16.068055Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"openSUSE-SU-2026:10009-1","title":"log4j-2.20.0-1.1 on GA media","description":"These are all security issues fixed in the log4j-2.20.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-06T00:00:00Z","modified":"2026-03-23T04:54:20.08952Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"openSUSE-SU-2026:20099-1","title":"Security update for coredns","description":"This update for coredns fixes the following issues:\n\nChanges in coredns:\n\n- fix CVE-2025-68156 bsc#1255345\n- fix CVE-2025-68161 bsc#1256411\n- Update to version 1.14.0:\n  * core: Fix gosec G115 integer overflow warnings\n  * core: Add regex length limit\n  * plugin/azure: Fix slice init length\n  * plugin/errors: Add optional show_first flag to consolidate directive\n  * plugin/file: Fix for misleading SOA parser warnings\n  * plugin/kubernetes: Rate limits to api server\n  * plugin/metrics: Implement plugin chain tracking\n  * plugin/sign: Report parser err before missing SOA\n  * build(deps): bump github.com/expr-lang/expr from 1.17.6 to 1.17.7\n\n- Update to version 1.13.2:\n  * core: Add basic support for DoH3\n  * core: Avoid proxy unnecessary alloc in Yield\n  * core: Fix usage of sync.Pool to save an alloc\n  * core: Fix data race with sync.RWMutex for uniq\n  * core: Prevent QUIC reload panic by lazily initializing the listener\n  * core: Refactor/use reflect.TypeFor\n  * plugin/auto: Limit regex length\n  * plugin/cache: Remove superfluous allocations in item.toMsg\n  * plugin/cache: Isolate metadata in prefetch goroutine\n  * plugin/cache: Correct spelling of MaximumDefaultTTL in cache and dnsutil\n    packages\n  * plugin/dnstap: Better error handling (redial \u0026 logging) when Dnstap is busy\n  * plugin/file: Performance finetuning\n  * plugin/forward: Disallow NOERROR in failover\n  * plugin/forward: Added support for per-nameserver TLS SNI\n  * plugin/forward: Prevent busy loop on connection err\n  * plugin/forward: Add max connect attempts knob\n  * plugin/geoip: Add ASN schema support\n  * plugin/geoip: Add support for subdivisions\n  * plugin/kubernetes: Fix kubernetes plugin logging\n  * plugin/multisocket: Cap num sockets to prevent OOM\n  * plugin/nomad: Support service filtering\n  * plugin/rewrite: Pre-compile CNAME rewrite regexp\n  * plugin/secondary: Fix reload causing secondary plugin goroutine to leak\n\n- Update to version 1.13.1:\n  * core: Avoid string concatenation in loops\n  * core: Update golang to 1.25.2 and golang.org/x/net to v0.45.0 on CVE fixes\n  * plugin/sign: Reject invalid UTF‑8 dbfile token\n\n- Update to version 1.13.0:\n  * core: Export timeout values in dnsserver.Server\n  * core: Fix Corefile infinite loop on unclosed braces\n  * core: Fix Corefile related import cycle issue\n  * core: Normalize panics on invalid origins\n  * core: Rely on dns.Server.ShutdownContext to gracefully stop\n  * plugin/dnstap: Add bounds for plugin args\n  * plugin/file: Fix data race in tree Elem.Name\n  * plugin/forward: No failover to next upstream when receiving SERVFAIL or\n    REFUSED response codes\n  * plugin/grpc: Enforce DNS message size limits\n  * plugin/loop: Prevent panic when ListenHosts is empty\n  * plugin/loop: Avoid panic on invalid server block\n  * plugin/nomad: Add a Nomad plugin\n  * plugin/reload: Prevent SIGTERM/reload deadlock\n\n- fix CVE-2025-58063 bsc#1249389\n- Update to version 1.12.4:\n  * bump deps\n  * fix(transfer): goroutine leak on axfr err (#7516)\n  * plugin/etcd: fix import order for ttl test (#7515)\n  * fix(grpc): check proxy list length in policies (#7512)\n  * fix(https): propagate HTTP request context (#7491)\n  * fix(plugin): guard nil lookups across plugins (#7494)\n  * lint: add missing prealloc to backend lookup test (#7510)\n  * fix(grpc): span leak on error attempt (#7487)\n  * test(plugin): improve backend lookup coverage (#7496)\n  * lint: enable prealloc (#7493)\n  * lint: enable durationcheck (#7492)\n  * Add Sophotech to adopters list (#7495)\n  * plugin: Use %w to wrap user error (#7489)\n  * fix(metrics): add timeouts to metrics HTTP server (#7469)\n  * chore(ci): restrict token permissions (#7470)\n  * chore(ci): pin workflow dependencies (#7471)\n  * fix(forward): use netip package for parsing (#7472)\n  * test(plugin): improve test coverage for pprof (#7473)\n  * build(deps): bump github.com/go-viper/mapstructure/v2 (#7468)\n  * plugin/file: fix label offset problem in ClosestEncloser (#7465)\n  * feat(trace): migrate dd-trace-go v1 to v2 (#7466)\n  * test(multisocket): deflake restart by using a fresh port and coordinated cleanup (#7438)\n  * chore: update Go version to 1.24.6 (#7437)\n  * plugin/header: Remove deprecated syntax (#7436)\n  * plugin/loadbalance: support prefer option (#7433)\n  * Improve caddy.GracefulServer conformance checks (#7416)\n\n- Update to version 1.12.3:\n  * chore: Minor changes to `Dockerfile` (#7428)\n  * Properly create hostname from IPv6 (#7431)\n  * Bump deps\n  * fix: handle cached connection closure in forward plugin (#7427)\n  * plugin/test: fix TXT record comparison for multi-chunk vs multiple records\n  * plugin/file: preserve case in SRV record names and targets per RFC 6763\n  * fix(auto/file): return REFUSED when no next plugin is available (#7381)\n  * Port to AWS Go SDK v2 (#6588)\n  * fix(cache): data race when refreshing cached messages (#7398)\n  * fix(cache): data race when updating the TTL of cached messages (#7397)\n  * chore: fix docs incompatibility (#7390)\n  * plugin/rewrite: Add EDNS0 Unset Action (#7380)\n  * add args: startup_timeout for kubernetes plugin (#7068)\n  * [plugin/cache] create a copy of a response to ensure original data is never\n     modified\n  * Add support for fallthrough to the grpc plugin (#7359)\n  * view: Add IPv6 example match (#7355)\n  * chore: enable more rules from revive (#7352)\n  * chore: enable early-return and superfluous-else from revive (#7129)\n  * test(plugin): improve tests for auto (#7348)\n  * fix(proxy): flaky dial tests (#7349)\n  * test: add t.Helper() calls to test helper functions (#7351)\n  * fix(kubernetes): multicluster DNS race condition (#7350)\n  * lint: enable wastedassign linter (#7340)\n  * test(plugin): add tests for any (#7341)\n  * Actually invoke make release -f Makefile.release during test (#7338)\n  * Keep golang to 1.24.2 due to build issues in 1.24.3 (#7337)\n  * lint: enable protogetter linter (#7336)\n  * lint: enable nolintlint linter (#7332)\n  * fix: missing intrange lint fix (#7333)\n  * perf(kubernetes): optimize AutoPath slice allocation (#7323)\n  * lint: enable intrange linter (#7331)\n  * feat(plugin/file): fallthrough (#7327)\n  * lint: enable canonicalheader linter (#7330)\n  * fix(proxy): avoid Dial hang after Transport stopped (#7321)\n  * test(plugin): add tests for pkg/rand (#7320)\n  * test(dnsserver): add unit tests for gRPC and QUIC servers (#7319)\n  * fix: loop variable capture and linter (#7328)\n  * lint: enable usetesting linter (#7322)\n  * test: skip certain network-specific tests on non-Linux (#7318)\n  * test(dnsserver): improve core/dnsserver test coverage (#7317)\n  * fix(metrics): preserve request size from plugins (#7313)\n  * fix: ensure DNS query name reset in plugin.NS error path (#7142)\n  * feat: enable plugins via environment during build (#7310)\n  * fix(plugin/bind): remove zone for link-local IPv4 (#7295)\n  * test(request): improve coverage across package (#7307)\n  * test(coremain): Add unit tests (#7308)\n  * ci(test-e2e): add Go version setup to workflow (#7309)\n  * kubernetes: add multicluster support (#7266)\n  * chore: Add new maintainer thevilledev (#7298)\n  * Update golangci-lint (#7294)\n  * feat: limit concurrent DoQ streams and goroutines (#7296)\n  * docs: add man page for multisocket plugin (#7297)\n  * Prepare for the k8s api upgrade (#7293)\n  * fix(rewrite): truncated upstream response (#7277)\n  * fix(plugin/secondary): make transfer property mandatory (#7249)\n  * plugin/bind: remove macOS bug mention in docs (#7250)\n  * Remove `?bla=foo:443` for `POST` DoH (#7257)\n  * Do not interrupt querying readiness probes for plugins (#6975)\n  * Added `SetProxyOptions` function for `forward` plugin (#7229)\n\n-  Backported quic-go PR #5094: Fix parsing of ifindex from packets\n   to ensure compatibility with big-endian architectures\n   (see quic-go/quic-go#4978, coredns/coredns#6682).\n\n- Update to version 1.12.1:\n  * core: Increase CNAME lookup limit from 7 to 10 (#7153)\n  * plugin/kubernetes: Fix handling of pods having DeletionTimestamp set\n  * plugin/kubernetes: Revert \"only create PTR records for endpoints with\n    hostname defined\"\n  * plugin/forward: added option failfast_all_unhealthy_upstreams to return\n    servfail if all upstreams are down\n  * bump dependencies, fixing bsc#1239294 and bsc#1239728\n\n- Update to version 1.12.0:\n  * New multisocket plugin - allows CoreDNS to listen on multiple sockets\n  * bump deps\n\n- Update to version 1.11.4:\n  * forward plugin: new option next, to try alternate upstreams when receiving\n    specified response codes upstreams on (functions like the external plugin\n    alternate)\n  * dnssec plugin: new option to load keys from AWS Secrets Manager\n  * rewrite plugin: new option to revert EDNS0 option rewrites in responses\n\n- Update to version 1.11.3+git129.387f34d:\n  * fix CVE-2024-51744 (https://bugzilla.suse.com/show_bug.cgi?id=1232991)\n    build(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#6955)\n  * core: set cache-control max-age as integer, not float (#6764)\n  * Issue-6671: Fixed the order of plugins. (#6729)\n  * `root`: explicit mark `dnssec` support (#6753)\n  * feat: dnssec load keys from AWS Secrets Manager (#6618)\n  * fuzzing: fix broken oss-fuzz build (#6880)\n  * Replace k8s.io/utils/strings/slices by Go stdlib slices (#6863)\n  * Update .go-version to 1.23.2 (#6920)\n  * plugin/rewrite: Add \"revert\" parameter for EDNS0 options (#6893)\n  * Added OpenSSF Scorecard Badge (#6738)\n  * fix(cwd): Restored backwards compatibility of Current Workdir (#6731)\n  * fix: plugin/auto: call OnShutdown() for each zone at its own OnShutdown() (#6705)\n  * feature: log queue and buffer memory size configuration (#6591)\n  * plugin/bind: add zone for link-local IPv6 instead of skipping (#6547)\n  * only create PTR records for endpoints with hostname defined (#6898)\n  * fix: reverter should execute the reversion in reversed order (#6872)\n  * plugin/etcd: fix etcd connection leakage when reload (#6646)\n  * kubernetes: Add useragent (#6484)\n  * Update build (#6836)\n  * Update grpc library use (#6826)\n  * Bump go version from 1.21.11 to 1.21.12 (#6800)\n  * Upgrade antonmedv/expr to expr-lang/expr (#6814)\n  * hosts: add hostsfile as label for coredns_hosts_entries (#6801)\n  * fix TestCorefile1 panic for nil handling (#6802)\n","status":"published","published":"2026-01-24T09:09:32Z","modified":"2026-03-23T04:54:44.315094Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2026:0254-1","title":"Security update for log4j","description":"This update for log4j fixes the following issues:\n\nSecurity fixes:\n\n- CVE-2025-68161: Fixed absent TLS hostname verification\n      that may allow a man-in-the-middle attack (bsc#1255427)\n  \nOther fixes:\n\n- Upgrade to 2.18.0\n  * Added\n    + Add support for Jakarta Mail API in the SMTP appender.\n    + Add support for custom Log4j 1.x levels.\n    + Add support for adding and retrieving appenders in Log4j 1.x\n      bridge.\n    + Add support for custom LMAX disruptor WaitStrategy\n      configuration.\n    + Add support for Apache Extras' RollingFileAppender in Log4j\n      1.x bridge.\n    + Add MutableThreadContextMapFilter.\n    + Add support for 24 colors in highlighting\n  * Changed\n    + Improves ServiceLoader support on servlet containers.\n    + Make the default disruptor WaitStrategy used by Async Loggers\n      garbage-free.\n    + Do not throw UnsupportedOperationException when JUL\n      ApiLogger::setLevel is called.\n    + Support Spring 2.6.x.\n    + Move perf tests to log4j-core-its\n    + Upgrade the Flume Appender to Flume 1.10.0\n  * Fixed\n    + Fix minor typo #792.\n    + Improve validation and reporting of configuration errors.\n    + Allow enterprise id to be an OID fragment.\n    + Fix problem with non-uppercase custom levels.\n    + Avoid ClassCastException in JeroMqManager with custom\n      LoggerContextFactory #791.\n    + DirectWriteRolloverStrategy should use the current time when\n      creating files.\n    + Fixes the syslog appender in Log4j 1.x bridge, when used with\n      a custom layout.\n    + log4j-1.2-api 2.17.2 throws NullPointerException while\n      removing appender with name as null.\n    + Improve JsonTemplateLayout performance.\n    + Fix resolution of non-Log4j properties.\n    + Fixes Spring Boot logging system registration in a\n      multi-application environment.\n    + JAR file containing Log4j configuration isn’t closed.\n    + Properties defined in configuration using a value attribute\n      (as opposed to element) are read correctly.\n    + Syslog appender lacks the SocketOptions setting.\n    + Log4j 1.2 bridge should not wrap components unnecessarily.\n    + Update 3rd party dependencies for 2.18.0.\n    + SizeBasedTriggeringPolicy would fail to rename files properly\n      when integer pattern contained a leading zero.\n    + Fixes default SslConfiguration, when a custom keystore is\n      used.\n    + Fixes appender concurrency problems in Log4j 1.x bridge.\n    + Fix and test for race condition in FileUtils.mkdir().\n    + LocalizedMessage logs misleading errors on the console.\n    + Add missing message parameterization in RegexFilter.\n    + Add the missing context stack to JsonLayout template.\n    + HttpWatcher did not pass credentials when polling.\n    + UrlConnectionFactory.createConnection now accepts an\n      AuthorizationProvider as a parameter.\n    + The DirectWriteRolloverStrategy was not detecting the correct\n      index to use during startup.\n    + Async Loggers were including the location information by\n      default.\n    + ClassArbiter’s newBuilder method referenced the wrong class.\n    + Don’t use Paths.get() to avoid circular file systems.\n    + Fix parsing error, when XInclude is disabled.\n    + Fix LevelRangeFilterBuilder to align with log4j1’s behavior.\n    + Fixes problem with wrong ANSI escape code for bright colors\n    + Log4j 1.2 bridge should generate Log4j 2.x messages based on\n      the parameter runtime type.\n- Update to 2.19.0\n  * Added\n    + Add implementation of SLF4J2 fluent API.\n    + Add support for SLF4J2 stack-valued MDC.\n  * Changed\n    + Add getExplicitLevel method to LoggerConfig.\n    + Allow PropertySources to be added.\n    + Allow Plugins to be injected with the LoggerContext reference.\n  * Fixed\n    + Add correct manifest entries for OSGi to log4j-jcl\n    + Improve support for passwordless keystores.\n    + SystemPropertyArbiter was assigning the value as the name.\n    + Make JsonTemplateLayout stack trace truncation operate for\n      each label block.\n    + Fix recursion between Log4j 1.2 LogManager and Category.\n    + Fix resolution of properties not starting with log4j2..\n    + Logger$PrivateConfig.filter(Level, Marker, String) was\n      allocating empty varargs array.\n    + Allows a space separated list of style specifiers in the\n      %style pattern for consistency with %highlight.\n    + Fix NPE in log4j-to-jul in the case the root logger level is\n      null.\n    + Fix RollingRandomAccessFileAppender with\n      DirectWriteRolloverStrategy can’t create the first log file of\n      different directory.\n    + Generate new SSL certs for testing.\n    + Fix ServiceLoaderUtil behavior in the presence of a\n      SecurityManager.\n    + Fix regression in Rfc5424Layout default values.\n    + Harden InstantFormatter against delegate failures.\n    + Add async support to Log4jServletFilter.\n  * Removed\n    + Removed build page in favor of a single build instructions\n      file.\n    + Remove SLF4J 1.8.x binding.\n- Update to 2.20.0\n  * Added\n    + Add support for timezones in RollingFileAppender date pattern\n    + Add LogEvent timestamp to ProducerRecord in KafkaAppender\n    + Add PatternLayout support for abbreviating the name of all\n      logger components except the 2 rightmost\n    + Removes internal field that leaked into public API.\n    + Add a LogBuilder#logAndGet() method to emulate the\n      Logger#traceEntry method.\n  * Changed\n    + Simplify site generation\n    + Switch the issue tracker from JIRA to GitHub Issues\n    + Remove liquibase-log4j2 maven module\n    + Fix order of stacktrace elements, that causes cache misses in\n      ThrowableProxyHelper.\n    + Switch from com.sun.mail to Eclipse Angus.\n    + Add Log4j2 Core as default runtime dependency of the\n      SLF4J2-to-Log4j2 API bridge.\n    + Replace maven-changes-plugin with a custom changelog\n      implementation\n    + Moved log4j-api and log4j-core artifacts with classifier tests\n      to log4j-api-test and log4j-core-test respectively.\n  * Deprecated\n    + Deprecate support for package scanning for plugins\n  * Fixed\n    + Copy programmatically supplied location even if\n      includeLocation='false'.\n    + Eliminate status logger warning, when disableAnsi or\n      noConsoleNoAnsi is used the style and highlight patterns.\n    + Fix detection of location requirements in RewriteAppender.\n    + Replace regex with manual code to escape characters in\n      Rfc5424Layout.\n    + Fix java.sql.Time object formatting in MapMessage\n    + Fix previous fire time computation in CronTriggeringPolicy\n    + Correct default to not include location for AsyncRootLoggers\n    + Make StatusConsoleListener use SimpleLogger internally.\n    + Lazily evaluate the level of a SLF4J LogEventBuilder\n    + Fixes priority of Legacy system properties, which are now back\n      to having higher priority than Environment variables.\n    + Protects ServiceLoaderUtil from unchecked ServiceLoader\n      exceptions.\n    + Fix Configurator#setLevel for internal classes\n    + Fix level propagation in Log4jBridgeHandler\n    + Disable OsgiServiceLocator if not running in OSGI container.\n    + When using a Date Lookup in the file pattern the current time\n      should be used.\n    + Fixed LogBuilder filtering in the presence of global filters.\n","status":"published","published":"2026-01-22T16:08:26Z","modified":"2026-03-23T04:52:04.123472Z","updated_at":"2026-11-02T15:54:00.846737Z"}]}}