{"cve":"CVE-2021-45105","nvd":{"published":"2021-12-18T12:15:07.433","modified":"2026-08-25T16:28:27.310","status":"Modified","description":"Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":5.9},"cwes":["CWE-20","CWE-674"],"references":["http://www.openwall.com/lists/oss-security/2021/12/19/1","https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf","https://logging.apache.org/log4j/2.x/security.html","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032"],"products":["apache:log4j","debian:debian_linux","netapp:cloud_manager","oracle:agile_engineering_data_management","oracle:agile_plm_mcad_connector","oracle:agile_product_lifecycle_management","oracle:autovue_for_agile_product_lifecycle_management","oracle:banking_deposits_and_lines_of_credit_servicing","oracle:banking_enterprise_default_management","oracle:banking_loans_servicing","oracle:banking_party_management","oracle:banking_payments","oracle:banking_platform","oracle:banking_trade_finance","oracle:banking_treasury_management","oracle:business_intelligence","oracle:communications_asap","oracle:communications_billing_and_revenue_management","oracle:communications_cloud_native_core_console","oracle:communications_cloud_native_core_network_function_cloud_native_environment","oracle:communications_cloud_native_core_network_repository_function","oracle:communications_cloud_native_core_network_slice_selection_function","oracle:communications_cloud_native_core_policy","oracle:communications_cloud_native_core_security_edge_protection_proxy","oracle:communications_cloud_native_core_service_communication_proxy","oracle:communications_cloud_native_core_unified_data_repository","oracle:communications_convergence","oracle:communications_convergent_charging_controller","oracle:communications_diameter_signaling_router","oracle:communications_eagle_element_management_system","oracle:communications_eagle_ftp_table_base_retrieval","oracle:communications_element_manager","oracle:communications_evolved_communications_application_server","oracle:communications_interactive_session_recorder","oracle:communications_ip_service_activator","oracle:communications_messaging_server","oracle:communications_network_charging_and_control","oracle:communications_network_integrity","oracle:communications_performance_intelligence_center","oracle:communications_pricing_design_center","oracle:communications_service_broker","oracle:communications_services_gatekeeper","oracle:communications_session_report_manager","oracle:communications_session_route_manager","oracle:communications_unified_inventory_management","oracle:communications_user_data_repository","oracle:communications_webrtc_session_controller","oracle:data_integrator","oracle:e-business_suite","oracle:enterprise_manager_base_platform"],"source":"nvd","synced_at":"2026-10-19T21:25:41.256909649+00:00"},"epss":{"cve":"CVE-2021-45105","score":0.99999,"percentile":0.9999,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-p6xc-xr62-6r2g","url":"https://osv.dev/vulnerability/GHSA-p6xc-xr62-6r2g","summary":"Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion","modified":"2026-06-09T10:30:14.432177927Z","packages":[{"ecosystem":"Maven","name":"org.apache.logging.log4j:log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core","ranges":[">=2.4.0 <2.12.3"],"fixed":["2.12.3"]},{"ecosystem":"Maven","name":"org.apache.logging.log4j:log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core","ranges":[">=2.13.0 <2.17.0"],"fixed":["2.17.0"]},{"ecosystem":"Maven","name":"org.apache.logging.log4j:log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core","ranges":["<2.3.1"],"fixed":["2.3.1"]},{"ecosystem":"Maven","name":"org.ops4j.pax.logging:pax-logging-log4j2","purl":"pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2","ranges":[">=1.8.0 <1.9.2"],"fixed":["1.9.2"]},{"ecosystem":"Maven","name":"org.ops4j.pax.logging:pax-logging-log4j2","purl":"pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2","ranges":[">=1.10.0 <1.10.9"],"fixed":["1.10.9"]},{"ecosystem":"Maven","name":"org.ops4j.pax.logging:pax-logging-log4j2","purl":"pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2","ranges":[">=1.11.0 <1.11.12"],"fixed":["1.11.12"]},{"ecosystem":"Maven","name":"org.ops4j.pax.logging:pax-logging-log4j2","purl":"pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2","ranges":[">=2.0.0 <2.0.13"],"fixed":["2.0.13"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}