CVE-2019-17571

9.8 criticalEPSS 70%

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 70% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE: CWE-502
Published: 2019-12-20
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:bookkeeper
apache:log4j
canonical:ubuntu_linux
debian:debian_linux
netapp:oncommand_system_manager
netapp:oncommand_workflow_automation
opensuse:leap
oracle:application_testing_suite
oracle:communications_network_integrity
oracle:endeca_information_discovery_studio
oracle:financial_services_lending_and_leasing
oracle:mysql_enterprise_monitor
oracle:primavera_gateway
oracle:rapid_planning
oracle:retail_extract_transform_and_load
oracle:retail_service_backbone
oracle:weblogic_server

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-2qrg-x229-3v8q	Maven	log4j:log4j	>=1.2 <=1.2.17	no fix published
GHSA-2qrg-x229-3v8q	Maven	org.zenframework.z8.dependencies.commons:log4j-1.2.17	2.0	no fix published

References

Check your stack JSON