CVE-2021-45046GHSA-7rjr-3q55-vv33
Apache Log4j2 Deserialization of Untrusted Data Vulnerability
Apache Log4j2mavenLibraries & packages
CVSS
9.0CriticalExploit odds (EPSS)>99.9%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS
CISA required actionApply updates per vendor instructions. CISA KEV
What fixes it
- 2.16.0org.apache.logging.log4j:log4j-core, mavenGitHub
<dependency><groupId>org.apache.logging.log4j</groupId><artifactId>log4j-core</artifactId><version>2.16.0</version></dependency> - 1.9.2org.ops4j.pax.logging:pax-logging-log4j2, mavenGitHub
<dependency><groupId>org.ops4j.pax.logging</groupId><artifactId>pax-logging-log4j2</artifactId><version>1.9.2</version></dependency> - 1.10.8org.ops4j.pax.logging:pax-logging-log4j2, mavenGitHub
<dependency><groupId>org.ops4j.pax.logging</groupId><artifactId>pax-logging-log4j2</artifactId><version>1.10.8</version></dependency> - 1.11.11org.ops4j.pax.logging:pax-logging-log4j2, mavenGitHub
<dependency><groupId>org.ops4j.pax.logging</groupId><artifactId>pax-logging-log4j2</artifactId><version>1.11.11</version></dependency> - 2.0.12org.ops4j.pax.logging:pax-logging-log4j2, mavenGitHub
<dependency><groupId>org.ops4j.pax.logging</groupId><artifactId>pax-logging-log4j2</artifactId><version>2.0.12</version></dependency> - 2.12.2org.apache.logging.log4j:log4j-core, mavenGitHub
<dependency><groupId>org.apache.logging.log4j</groupId><artifactId>log4j-core</artifactId><version>2.12.2</version></dependency>
Show all 15 fixed versions
- 2.3.1org.apache.logging.log4j:log4j-core, mavenGitHub
<dependency><groupId>org.apache.logging.log4j</groupId><artifactId>log4j-core</artifactId><version>2.3.1</version></dependency> - 2.16.0Apache Log4jCVE List
- 2.16.0org.apache.logging.log4j:log4j-core, MavenOSV
<dependency><groupId>org.apache.logging.log4j</groupId><artifactId>log4j-core</artifactId><version>2.16.0</version></dependency> - 2.12.2org.apache.logging.log4j:log4j-core, MavenOSV
<dependency><groupId>org.apache.logging.log4j</groupId><artifactId>log4j-core</artifactId><version>2.12.2</version></dependency> - 1.9.2org.ops4j.pax.logging:pax-logging-log4j2, MavenOSV
<dependency><groupId>org.ops4j.pax.logging</groupId><artifactId>pax-logging-log4j2</artifactId><version>1.9.2</version></dependency> - 1.10.8org.ops4j.pax.logging:pax-logging-log4j2, MavenOSV
<dependency><groupId>org.ops4j.pax.logging</groupId><artifactId>pax-logging-log4j2</artifactId><version>1.10.8</version></dependency> - 1.11.11org.ops4j.pax.logging:pax-logging-log4j2, MavenOSV
<dependency><groupId>org.ops4j.pax.logging</groupId><artifactId>pax-logging-log4j2</artifactId><version>1.11.11</version></dependency> - 2.0.12org.ops4j.pax.logging:pax-logging-log4j2, MavenOSV
<dependency><groupId>org.ops4j.pax.logging</groupId><artifactId>pax-logging-log4j2</artifactId><version>2.0.12</version></dependency> - 2.3.1org.apache.logging.log4j:log4j-core, MavenOSV
<dependency><groupId>org.apache.logging.log4j</groupId><artifactId>log4j-core</artifactId><version>2.3.1</version></dependency>
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Timeline
- 9 Dec 2021Exploit code publicMetasploit
- 14 Dec 2021, 16:55 UTCPublishedCVE List
- 1 May 2023Added to CISA KEVCISA KEV
Public exploit code and templates 2
- Auxiliary moduleLog4Shell HTTP Scanner 9 Dec 2021Metasploit
- Scanner templateApache Log4j2 - Remote Code InjectionNuclei
Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.
Description
Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.
Text from CVE List
Affected versions 100
- org.apache.logging.log4j:log4j-core, maven>= 2.13.0, < 2.16.0GitHub
- org.ops4j.pax.logging:pax-logging-log4j2, maven>= 1.8.0, < 1.9.2GitHub
- org.ops4j.pax.logging:pax-logging-log4j2, maven>= 1.10.0, < 1.10.8GitHub
- org.ops4j.pax.logging:pax-logging-log4j2, maven>= 1.11.0, < 1.11.11GitHub
- org.ops4j.pax.logging:pax-logging-log4j2, maven>= 2.0.0, < 2.0.12GitHub
- org.apache.logging.log4j:log4j-core, maven>= 2.4.0, < 2.12.2GitHub
- org.apache.logging.log4j:log4j-core, maven< 2.3.1GitHub
- Apache Log4jaffected: Apache Log4j2 before 2.16.0CVE List
- org.apache.logging.log4j:log4j-core, Mavenfrom 2.13.0, fixed in 2.16.0OSV
- org.apache.logging.log4j:log4j-core, Maven2.13.0OSV
- org.apache.logging.log4j:log4j-core, Maven2.13.1OSV
- org.apache.logging.log4j:log4j-core, Maven2.13.2OSV
- org.apache.logging.log4j:log4j-core, Maven2.13.3OSV
- org.apache.logging.log4j:log4j-core, Maven2.14.0OSV
- org.apache.logging.log4j:log4j-core, Maven2.14.1OSV
- org.apache.logging.log4j:log4j-core, Maven2.15.0OSV
- org.apache.logging.log4j:log4j-core, Mavenfrom 2.4.0, fixed in 2.12.2OSV
- org.apache.logging.log4j:log4j-core, Maven2.10.0OSV
- org.apache.logging.log4j:log4j-core, Maven2.11.0OSV
- org.apache.logging.log4j:log4j-core, Maven2.11.1OSV
- org.apache.logging.log4j:log4j-core, Maven2.11.2OSV
- org.apache.logging.log4j:log4j-core, Maven2.12.0OSV
- org.apache.logging.log4j:log4j-core, Maven2.12.1OSV
- org.apache.logging.log4j:log4j-core, Maven2.4OSV
- org.apache.logging.log4j:log4j-core, Maven2.4.1OSV
- org.apache.logging.log4j:log4j-core, Maven2.5OSV
- org.apache.logging.log4j:log4j-core, Maven2.6OSV
- org.apache.logging.log4j:log4j-core, Maven2.6.1OSV
- org.apache.logging.log4j:log4j-core, Maven2.6.2OSV
- org.apache.logging.log4j:log4j-core, Maven2.7OSV
- org.apache.logging.log4j:log4j-core, Maven2.8OSV
- org.apache.logging.log4j:log4j-core, Maven2.8.1OSV
- org.apache.logging.log4j:log4j-core, Maven2.8.2OSV
- org.apache.logging.log4j:log4j-core, Maven2.9.0OSV
- org.apache.logging.log4j:log4j-core, Maven2.9.1OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Mavenfrom 1.8.0, fixed in 1.9.2OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.8.0OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.8.1OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.8.2OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.8.3OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.8.4OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.8.5OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.8.6OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.8.7OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.9.0OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.9.1OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Mavenfrom 1.10.0, fixed in 1.10.8OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.10.0OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.10.1OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.10.2OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.10.3OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.10.4OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.10.5OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.10.6OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.10.7OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Mavenfrom 1.11.0, fixed in 1.11.11OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.11.0OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.11.1OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.11.10OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.11.2OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.11.3OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.11.4OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.11.5OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.11.6OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.11.7OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.11.8OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven1.11.9OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Mavenfrom 2.0.0, fixed in 2.0.12OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven2.0.0OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven2.0.1OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven2.0.10OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven2.0.11OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven2.0.2OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven2.0.3OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven2.0.4OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven2.0.5OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven2.0.6OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven2.0.7OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven2.0.8OSV
- org.ops4j.pax.logging:pax-logging-log4j2, Maven2.0.9OSV
- org.apache.logging.log4j:log4j-core, Mavenfrom first release, fixed in 2.3.1OSV
- org.apache.logging.log4j:log4j-core, Maven2.0OSV
- org.apache.logging.log4j:log4j-core, Maven2.0-alpha1OSV
- org.apache.logging.log4j:log4j-core, Maven2.0-alpha2OSV
- org.apache.logging.log4j:log4j-core, Maven2.0-beta1OSV
- org.apache.logging.log4j:log4j-core, Maven2.0-beta2OSV
- org.apache.logging.log4j:log4j-core, Maven2.0-beta3OSV
- org.apache.logging.log4j:log4j-core, Maven2.0-beta4OSV
- org.apache.logging.log4j:log4j-core, Maven2.0-beta5OSV
- org.apache.logging.log4j:log4j-core, Maven2.0-beta6OSV
- org.apache.logging.log4j:log4j-core, Maven2.0-beta7OSV
- org.apache.logging.log4j:log4j-core, Maven2.0-beta8OSV
- org.apache.logging.log4j:log4j-core, Maven2.0-beta9OSV
- org.apache.logging.log4j:log4j-core, Maven2.0-rc1OSV
- org.apache.logging.log4j:log4j-core, Maven2.0-rc2OSV
- org.apache.logging.log4j:log4j-core, Maven2.0.1OSV
- org.apache.logging.log4j:log4j-core, Maven2.0.2OSV
- org.apache.logging.log4j:log4j-core, Maven2.1OSV
- org.apache.logging.log4j:log4j-core, Maven2.2OSV
- org.apache.logging.log4j:log4j-core, Maven2.3OSV
References 29
- logging.apache.org/log4j/2.x/security.htmlAdvisoryvia CVE List
- openwall.com/lists/oss-security/2021/12/14/4Advisoryvia GitHub
- intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.htmlAdvisoryvia CVE List
- cert-portal.siemens.com/productcert/pdf/ssa-661247.pdfAdvisoryvia CVE List
- cert-portal.siemens.com/productcert/pdf/ssa-714170.pdfAdvisoryvia CVE List
- kb.cert.org/vuls/id/930724Advisoryvia CVE List
- debian.org/security/2021/dsa-5022Advisoryvia CVE List
- psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032Advisoryvia CVE List
- oracle.com/security-alerts/alert-cve-2021-44228.htmlAdvisoryvia CVE List
- cert-portal.siemens.com/productcert/pdf/ssa-397453.pdfAdvisoryvia CVE List
- cert-portal.siemens.com/productcert/pdf/ssa-479842.pdfAdvisoryvia CVE List
- oracle.com/security-alerts/cpujan2022.htmlAdvisoryvia CVE List
- oracle.com/security-alerts/cpuapr2022.htmlAdvisoryvia CVE List
- oracle.com/security-alerts/cpujul2022.htmlAdvisoryvia CVE List
- security.gentoo.org/glsa/202310-16Advisoryvia CVE List
- sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbdAdvisoryvia GitHub
- openwall.com/lists/oss-security/2021/12/18/1Advisoryvia GitHub
- openwall.com/lists/oss-security/2021/12/15/3Advisoryvia GitHub
- logging.apache.org/security.html#CVE-2021-45046Advisoryvia GitHub
- github.com/advisories/GHSA-7rjr-3q55-vv33Advisoryvia GitHub
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbdAdvisoryvia CVE List
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY/Advisoryvia CVE List
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ/Advisoryvia CVE List
- nvd.nist.gov/vuln/detail/CVE-2021-45046Referencevia GitHub
- cve.org/CVERecord?id=CVE-2021-44228Referencevia CVE List
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJReferencevia GitHub
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCYReferencevia GitHub
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-45046Referencevia CVE List
- github.com/apache/logging-log4j2/compare/rel/2.3...rel/2.3.1Referencevia GitHub