What’s Vulnerable › Products

Apache Log4j vulnerabilities

20 known vulnerabilities, 2 confirmed exploited in the wild (CISA KEV), 7 published in the last 12 months.

Check whether your Apache Log4j version is affected

Exploited Apache Log4j vulnerabilities

• CVE-2021-45046 — Apache Log4j2 Deserialization of Untrusted Data Vulnerability
• CVE-2021-44228 — Apache Log4j2 Remote Code Execution Vulnerability

Latest Apache Log4j vulnerabilities

• CVE-2026-49844 — Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson() (CVSS 5.9)
• CVE-2026-34481 — Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout (CVSS 7.5)
• CVE-2026-34480 — Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters (CVSS 7.5)
• CVE-2026-34479 — Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters (CVSS 7.5)
• CVE-2026-34478 — Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility (CVSS 7.5)
• CVE-2026-34477 — Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass (CVSS 5.9)
• CVE-2025-68161 — Apache Log4j Core: Missing TLS hostname verification in Socket appender (CVSS 4.8)
• CVE-2023-26464 — Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender (CVSS 7.5)
• CVE-2022-23307 — A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution. (CVSS 8.8)
• CVE-2022-23305 — SQL injection in JDBC Appender in Apache Log4j V1 (CVSS 9.8)
• CVE-2022-23302 — Deserialization of untrusted data in JMSSink in Apache Log4j 1.x (CVSS 8.8)
• CVE-2021-44832 — Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration (CVSS 6.6)
• CVE-2021-45105 — Apache Log4j2 does not always protect from infinite recursion in lookup evaluation (CVSS 5.9)
• CVE-2021-45046 — Apache Log4j2 Deserialization of Untrusted Data Vulnerability (CVSS 9.0) — exploited
• CVE-2021-4104 — Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 (CVSS 7.5)
• CVE-2021-44228 — Apache Log4j2 Remote Code Execution Vulnerability (CVSS 10.0) — exploited
• CVE-2020-9493 — Java deserialization in Chainsaw (CVSS 9.8)
• CVE-2020-9488 — (CVSS 3.7)
• CVE-2019-17571 — (CVSS 9.8)
• CVE-2017-5645 — (CVSS 9.8)