What’s Vulnerable › Vulnerabilities

CVE-2021-45105: Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 100.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-12-18 · updated 2026-08-25
• Weakness: CWE-20

Description

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

Affected products

• Apache Log4j: from 2.0 before 2.3.1; from 2.4 before 2.12.3; from 2.13.0 through 2.16.0 — fixed in 2.12.3, 2.3.1
• Debian Linux: 10.0, 11.0
• Cloud Manager: all versions
• Oracle Corporation Oracle Agile Engineering Data Management: 6.2.1.0
• Oracle Corporation Oracle Agile PLM MCAD Connector: 3.6
• Oracle Corporation Oracle Agile PLM: 9.3.6
• Oracle Autovue For Agile Product Lifecycle Management: 21.0.2
• Oracle Banking Deposits And Lines Of Credit Servicing: 2.12.0
• Oracle Banking Enterprise Default Management: 2.7.1, 2.12.0
• Oracle Banking Loans Servicing: 2.12.0
• Oracle Banking Party Management: 2.7.0
• Oracle Corporation Banking Payments: 14.5
• Oracle Banking Platform: 2.6.2, 2.7.1, 2.12.0
• Oracle Corporation Banking Trade Finance: 14.5
• Oracle Corporation Banking Treasury Management: 14.5
• Oracle Corporation Oracle Business Intelligence Enterprise Edition: 5.5.0.0.0
• Oracle Communications Asap: 7.3
• Oracle Corporation Communications Billing and Revenue Management: 12.0.0.4, 12.0.0.5
• Oracle Communications Cloud Native Core Console: 1.9.0
• Oracle Communications Cloud Native Core Network Function Cloud Native Environment: 1.10.0
• Oracle Communications Cloud Native Core Network Repository Function: 1.15.0, 1.15.1
• Oracle Communications Cloud Native Core Network Slice Selection Function: 1.8.0
• Oracle Communications Cloud Native Core Policy: 1.15.0
• Oracle Communications Cloud Native Core Security Edge Protection Proxy: 1.7.0
• Oracle Communications Cloud Native Core Service Communication Proxy: 1.15.0
• Oracle Communications Cloud Native Core Unified Data Repository: 1.15.0
• Oracle Corporation Communications Convergence: 3.0.2.2.0, 3.0.3.0
• Oracle Corporation Oracle Communications Convergent Charging Controller: from 12.0.1.0.0 through 12.0.4.0.0; 6.0.1.0.0
• Oracle Corporation Communications Diameter Signaling Router (DSR): from 8.3.0.0 through 8.5.1.0
• Oracle Communications Eagle Element Management System: 46.6

How to fix

Upgrade to a fixed version: Apache Log4j 2.12.3, 2.3.1; Oracle Communications Element Manager 9.0; Oracle Communications Session Report Manager 9.0; Oracle Communications Session Route Manager 9.0. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2021/12/19/1
• https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
• https://logging.apache.org/log4j/2.x/security.html
• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
• https://security.netapp.com/advisory/ntap-20211218-0001/
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
• https://www.debian.org/security/2021/dsa-5024
• https://www.kb.cert.org/vuls/id/930724
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpujul2022.html

Get alerted when CVE-2021-45105 or the next vulnerability affects your stack