{"cve":"CVE-2017-5645","nvd":{"published":"2017-04-17T21:59:00.373","modified":"2026-10-08T22:16:40.790","status":"Modified","description":"In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-502"],"references":["http://www.openwall.com/lists/oss-security/2019/12/19/2","http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html","http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html"],"products":["apache:log4j","netapp:oncommand_api_services","netapp:oncommand_insight","netapp:oncommand_workflow_automation","netapp:service_level_manager","netapp:snapcenter","netapp:storage_automation_store","oracle:api_gateway","oracle:application_testing_suite","oracle:autovue_vuelink_integration","oracle:banking_platform","oracle:bi_publisher","oracle:communications_converged_application_server_-_service_controller","oracle:communications_instant_messaging_server","oracle:communications_interactive_session_recorder","oracle:communications_messaging_server","oracle:communications_network_integrity","oracle:communications_online_mediation_controller","oracle:communications_pricing_design_center","oracle:communications_service_broker","oracle:communications_webrtc_session_controller","oracle:configuration_manager","oracle:endeca_information_discovery_studio","oracle:enterprise_data_quality","oracle:enterprise_manager_base_platform","oracle:enterprise_manager_for_fusion_middleware","oracle:enterprise_manager_for_mysql_database","oracle:enterprise_manager_for_oracle_database","oracle:enterprise_manager_for_peoplesoft","oracle:financial_services_analytical_applications_infrastructure","oracle:financial_services_behavior_detection_platform","oracle:financial_services_hedge_management_and_ifrs_valuations","oracle:financial_services_lending_and_leasing","oracle:financial_services_loan_loss_forecasting_and_provisioning","oracle:financial_services_profitability_management","oracle:financial_services_regulatory_reporting_with_agilereporter","oracle:flexcube_investor_servicing","oracle:fusion_middleware_mapviewer","oracle:goldengate","oracle:goldengate_application_adapters","oracle:identity_analytics","oracle:identity_management_suite","oracle:identity_manager_connector","oracle:in-memory_performance-driven_planning","oracle:instantis_enterprisetrack","oracle:insurance_calculation_engine","oracle:insurance_policy_administration","oracle:insurance_rules_palette","oracle:jd_edwards_enterpriseone_tools","oracle:jdeveloper"],"source":"nvd","synced_at":"2026-10-19T20:42:09.859288039+00:00"},"epss":{"cve":"CVE-2017-5645","score":0.89358,"percentile":0.99781,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-fxph-q3j8-mv87","url":"https://osv.dev/vulnerability/GHSA-fxph-q3j8-mv87","summary":"Deserialization of Untrusted Data in Log4j","modified":"2024-03-14T05:19:26.806656Z","packages":[{"ecosystem":"Maven","name":"org.apache.logging.log4j:log4j","purl":"pkg:maven/org.apache.logging.log4j/log4j","ranges":[">=2.0 <2.8.2"],"fixed":["2.8.2"]},{"ecosystem":"Maven","name":"org.apache.logging.log4j:log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core","ranges":[">=2.0 <2.8.2"],"fixed":["2.8.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}