Skip to content

RadicalNotion.AI

We do not sell or share your personal information

© 2026 RadicalNotion.AI

Security Data

CWE Directory
CAPEC Directory
CNA Directory
CNA Report Cards
Data Sources

Calculators

CVSS Calculator
CVSS 4.0
CVSS 3.1
CVSS 3.0
CVSS 2.0
Badge Builder

Platform

My Vulnerabilities
Insights
Notifications
Pricing

Learn

All guides
What is a CVE?
What is CVSS?
The CISA KEV catalog
What is EPSS?

Company

About us
Blog
Careers
Contact
Book a demo

Get Started

Sign up
Log in

Legal

Security
Privacy
Terms

RadicalNotion.AI

Security data

Weaknesses (CWE)The MITRE CWE weakness catalog
Attack Patterns (CAPEC)MITRE CAPEC attack patterns
CNAsNumbering authorities + report cards
VendorsVulnerabilities by vendor

Tools

CVSS CalculatorScore CVSS 4.0, 3.1, 3.0 & 2.0
Badge BuilderEmbeddable SVG badges for READMEs

Resources

LearnPlain-English security guides
Data SourcesHow we source CVE data

About Us Blog Pricing Book a Demo

Log in

Log in Start free

Home
Vendors
Apache
Log4j

Apache Software Foundation log4j Vulnerabilities: CVEs, CISA KEV & Security Advisories

Apache Software Foundation

19 CVEs

2 in CISA KEV

Apache Software Foundation log4j Vulnerabilities

CVE security advisories and vulnerability history for log4j by Apache Software Foundation.

19

Total CVEs

Published

2

In CISA KEV

Exploited in the wild

2

Public exploits

PoC or exploit code

7.7

Avg CVSS

2017–2026

Last updated April 10, 2026

Overview

Apache Software Foundation log4j has 19 published CVE records since 2017, of which 2 are in CISA's Known Exploited Vulnerabilities catalog and 2 have a known public exploit. The average CVSS base score across scored CVEs is 7.7.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Apache Software Foundation log4j, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of Apache Software Foundation log4j's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical6

High4

Medium8

Low1

In CISA’s Known Exploited Vulnerabilities catalog

2

2 of Apache Software Foundation log4j's CVEs are confirmed exploited in the wild.

Public exploits

2

2 of Apache Software Foundation log4j's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every Apache Software Foundation log4j version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

3.0.0 <= v <= 3.0.05 CVEs
2.0 <= v <= 2.04 CVEs
1.2 <= v < 2.02 CVEs
2.4 <= v < 2.12.32 CVEs
<= 1.2.171 CVE
>= versions up to 1.2.171 CVE
1.0.1 <= v <= 1.2.171 CVE
1.0.4 <= v < 2.01 CVE
1.2 <= v <= 1.21 CVE
1.2 <= v <= 1.2.171 CVE
2.0 <= v < 2.25.41 CVE
2.0 <= v < 2.3.11 CVE
2.0 <= v < 2.3.21 CVE
2.0 <= v < 2.8.21 CVE
2.0.1 <= v < 2.12.21 CVE
2.0.1 <= v < 2.25.31 CVE
2.0.1 <= v < 2.3.11 CVE
2.0.1 <= v < 2.3.21 CVE
2.12.0 <= v < 2.25.41 CVE
2.13.0 <= v < 2.13.21 CVE
2.13.0 <= v < 2.15.01 CVE
2.13.0 <= v < 2.16.01 CVE
2.13.0 <= v < 2.17.11 CVE
2.13.0 <= v <= 2.16.01 CVE
2.14.0 <= v < 2.25.41 CVE
2.21.0 <= v < 2.25.41 CVE
2.4 <= v < 2.12.41 CVE
2.4.0 <= v < 2.12.21 CVE
2.7 <= v < 2.25.41 CVE

Fixed in

2.25.45 CVEs
2.03 CVEs
2.12.22 CVEs
2.12.32 CVEs
2.3.12 CVEs
2.3.22 CVEs
2.12.41 CVE
2.13.21 CVE
2.15.01 CVE
2.16.01 CVE
2.17.11 CVE
2.25.31 CVE
2.8.21 CVE

Find a version

19 CVEs

Sort

Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout
CVE-2026-34481
Patch
CWE-116
Medium · CVSS 6.3
EPSS 0.6% (42th pct)2026-04-10
Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters
CVE-2026-34480
Patch
CWE-116
Medium · CVSS 6.9
EPSS 0.9% (54th pct)2026-04-10
Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters
CVE-2026-34479
Patch
CWE-116
Medium · CVSS 6.9
EPSS 0.5% (41th pct)2026-04-10
Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility
CVE-2026-34478
Patch
CWE-684
Medium · CVSS 6.9
EPSS 0.8% (53th pct)2026-04-10
Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass
CVE-2026-34477
Patch
CWE-297
Medium · CVSS 6.3
EPSS 0.4% (32th pct)2026-04-10
Apache Log4j Core: Missing TLS hostname verification in Socket appender
CVE-2025-68161
Patch
CWE-297
Medium · CVSS 6.3
EPSS 0.7% (50th pct)2025-12-18
Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender
CVE-2023-26464
Patch
CWE-502
High · CVSS 7.5
EPSS 1.9% (77th pct)2023-03-10
A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.
CVE-2022-23307
Patch
Workaround
CWE-502
High · CVSS 8.8
EPSS 52.5% (99th pct)2022-01-18
SQL injection in JDBC Appender in Apache Log4j V1
CVE-2022-23305
Patch
Workaround
CWE-89
Critical · CVSS 9.8
EPSS 66.5% (99th pct)2022-01-18
Deserialization of untrusted data in JMSSink in Apache Log4j 1.x
CVE-2022-23302
Patch
Workaround
CWE-502
High · CVSS 8.8
EPSS 61.8% (99th pct)2022-01-18
Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration
CVE-2021-44832
Patch
CWE-20
Medium · CVSS 6.6
EPSS 97.9% (100th pct)2021-12-28
Apache Log4j2 does not always protect from infinite recursion in lookup evaluation
CVE-2021-45105
Patch
Workaround
CWE-20
Medium · CVSS 5.9
EPSS 100.0% (100th pct)2021-12-18
Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
CVE-2021-45046
CISA KEV
Public exploit
Patch
CWE-917
Added to CISA KEV 2023-05-01
Critical · CVSS 9.0
EPSS 100.0% (100th pct)2021-12-14
Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2
CVE-2021-4104
Patch
CWE-502
High · CVSS 7.5
EPSS 81.1% (100th pct)2021-12-14
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
CVE-2021-44228
CISA KEV
Public exploit
Patch
CWE-502
Added to CISA KEV 2021-12-10
Critical · CVSS 10.0
EPSS 100.0% (100th pct)2021-12-10
Java deserialization in Chainsaw
CVE-2020-9493
Patch
Workaround
CWE-502
Critical · CVSS 9.8
EPSS 4.6% (91th pct)2021-06-16
Low vulnerability · 2020-04-27
CVE-2020-9488
Patch
CWE-295
Low · CVSS 3.7
EPSS 8.1% (94th pct)2020-04-27
Critical vulnerability · 2019-12-20
CVE-2019-17571
Patch
CWE-502
Critical · CVSS 9.8
EPSS 69.1% (99th pct)2019-12-20
Critical vulnerability · 2017-04-17
CVE-2017-5645
Patch
Critical · CVSS 9.8
EPSS 89.0% (100th pct)2017-04-17

Common weakness types

The CWE weakness categories most often found in Apache Software Foundation log4j CVEs. Follow any weakness for its full explanation.

CWE-502Deserialization of Untrusted Data7 CVEs
CWE-116Improper Encoding or Escaping of Output3 CVEs
CWE-297Improper Validation of Certificate with Host Mismatch2 CVEs
CWE-20Improper Input Validation2 CVEs
CWE-295Improper Certificate Validation1 CVE
CWE-684Incorrect Provision of Specified Functionality1 CVE
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')1 CVE
CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')1 CVE

Disclosure activity by year

How many Apache Software Foundation log4j CVEs were published each year.

2017

1

2019

1

2020

1

2021

6

2022

3

2023

1

2025

1

2026

5

Other Apache Software Foundation products

Browse vulnerabilities for other products by Apache Software Foundation.

http server342 CVEs tomcat251 CVEs airflow181 CVEs Apache Airflow136 CVEs Apache HTTP Server125 CVEs httpd125 CVEs Apache Tomcat113 CVEs struts86 CVEs

All Apache Software Foundation vulnerabilities

Frequently asked questions

Common questions about Apache Software Foundation log4j vulnerabilities.

How many CVEs does Apache Software Foundation log4j have?: Apache Software Foundation log4j has 19 published CVE records since 2017.
How many Apache Software Foundation log4j CVEs are in CISA KEV?: Yes — 2 of Apache Software Foundation log4j's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Are there public exploits for Apache Software Foundation log4j vulnerabilities?: Yes — 2 of Apache Software Foundation log4j's CVEs have a known public exploit.
Which versions of Apache Software Foundation log4j are affected?: 42 distinct Apache Software Foundation log4j versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Apache Software Foundation log4j CVEs?: Apache Software Foundation log4j's CVEs most often map to these CWE weakness types: CWE-502 (Deserialization of Untrusted Data), CWE-116 (Improper Encoding or Escaping of Output), CWE-297 (Improper Validation of Certificate with Host Mismatch), CWE-20 (Improper Input Validation).
How many critical Apache Software Foundation log4j vulnerabilities are there?: Apache Software Foundation log4j has 6 critical and 4 high-severity CVEs.
What is the average severity of Apache Software Foundation log4j CVEs?: The average CVSS base score across Apache Software Foundation log4j's scored CVEs is 7.7.

References

All Apache Software Foundation vulnerabilities
The MITRE CVE Program (opens in a new tab)
Learn: What is a CVE?
CWE directory: the weakness types these CVEs map to

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Apache Software Foundation log4j vulnerabilities

Monitor new Apache Software Foundation log4j vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

On this page

Overview
Severity and exploitation
Affected versions and CVEs
Common weakness types
Disclosure activity
Other products
FAQ
References