Apache Log4j vulnerabilities

• apache log4j, apache software foundation log4j api +1 more Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson() CVE-2026-49844 Public exploitFix available 6.3 MediumJuly 10, 2026
• apache log4j, apache software foundation log4j json template layout +1 more Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout CVE-2026-34481 Fix available 6.3 MediumApril 10, 2026
• apache log4j, apache software foundation log4j core +1 more Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters CVE-2026-34480 Fix available 6.9 MediumApril 10, 2026
• apache log4j, apache software foundation log4j 1 to log4j 2 bridge +1 more Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters CVE-2026-34479 Fix available 6.9 MediumApril 10, 2026
• apache log4j, apache software foundation log4j core +1 more Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility CVE-2026-34478 Fix available 6.9 MediumApril 10, 2026
• apache log4j, apache software foundation log4j core +1 more Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass CVE-2026-34477 Fix available 6.3 MediumApril 10, 2026
• apache log4j, apache software foundation log4j core +1 more Apache Log4j Core: Missing TLS hostname verification in Socket appender CVE-2025-68161 Fix available 6.3 MediumDecember 18, 2025
• apache log4j Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender CVE-2023-26464 Fix available 7.5 HighMarch 10, 2023
• apache chainsaw, log4j, apache software foundation log4j 1.x +24 more +26 more A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution. CVE-2022-23307 Fix available EPSS 54.4% 8.8 HighJanuary 18, 2022
• apache log4j, apache software foundation log4j 1.x, broadcom brocade sannav +26 more +28 more SQL injection in JDBC Appender in Apache Log4j V1 CVE-2022-23305 Public exploitFix available EPSS 66.5% 9.8 CriticalJanuary 18, 2022
• apache log4j, apache software foundation log4j 1.x, broadcom brocade sannav +24 more +26 more Deserialization of untrusted data in JMSSink in Apache Log4j 1.x CVE-2022-23302 Fix available EPSS 63.8% 8.8 HighJanuary 18, 2022
• apache log4j, apache software foundation log4j2, cisco cloudcenter +20 more +22 more Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration CVE-2021-44832 Public exploitFix available EPSS 97.9% 6.6 MediumDecember 28, 2021
• apache log4j, apache software foundation log4j2, debian linux +114 more +116 more Apache Log4j2 does not always protect from infinite recursion in lookup evaluation CVE-2021-45105 Public exploitFix available EPSS 100.0% 5.9 MediumDecember 18, 2021
• apache log4j, log4j2, cvat computer vision annotation tool +53 more +55 more Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack CVE-2021-45046 In KEVPublic exploitFix available EPSS 100.0% 9.0 CriticalDecember 14, 2021
• apache log4j, apache software foundation log4j 1.x, fedoraproject fedora +44 more +46 more Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 CVE-2021-4104 Public exploitFix available EPSS 80.6% 7.5 HighDecember 14, 2021
• apache log4j, log4j2, apple xcode +141 more +143 more Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints CVE-2021-44228 In KEVPublic exploitFix available EPSS 100.0% 10.0 CriticalDecember 10, 2021
• apache chainsaw, log4j, qos reload4j +2 more Java deserialization in Chainsaw CVE-2020-9493 Fix available 9.8 CriticalJune 16, 2021
• apache log4j, debian linux, oracle communications application session controller +43 more +45 more Improper validation of certificate with host mismatch in Apache Log4j SMTP appender CVE-2020-9488 Public exploitFix available 3.7 LowApril 27, 2020
• apache log4j, bookkeeper, canonical ubuntu linux +14 more +16 more Deserialization of Untrusted Data in Log4j CVE-2019-17571 Public exploitFix available EPSS 70.0% 9.8 CriticalDecember 20, 2019
• apache log4j, netapp oncommand api services, oncommand insight +76 more +78 more Deserialization of Untrusted Data in Log4j CVE-2017-5645 Public exploitFix available EPSS 89.4% 9.8 CriticalApril 17, 2017