org.apache.logging.log4j/log4j vulnerabilities

Latest org.apache.logging.log4j/log4j CVEs

Newest publication first

1. CVE-2020-9488 Improper validation of certificate with host mismatch in Apache Log4j SMTP appender

   Published 2020-04-27

   Low·CVSS 3.7 EPSS 8.2%

   Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

2. CVE-2017-5645 Deserialization of Untrusted Data in Log4j

   Published 2017-04-17

   Critical·CVSS 9.8 EPSS 89.4%

   In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.