CVSS 3.1
5.9 mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HCVE-2021-45105
Medium (5.9). EPSS 100% chance of exploitation in the next 30 days. Fixed in org.apache.logging.log4j:log4j-core 2.12.3, 2.17.0, 2.3.1.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
Severity
- EPSS
- 100% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-20, CWE-674
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apache:log4j
- debian:debian_linux
- netapp:cloud_manager
- oracle:agile_engineering_data_management
- oracle:agile_plm_mcad_connector
- oracle:agile_product_lifecycle_management
- oracle:autovue_for_agile_product_lifecycle_management
- oracle:banking_deposits_and_lines_of_credit_servicing
- oracle:banking_enterprise_default_management
- oracle:banking_loans_servicing
- oracle:banking_party_management
- oracle:banking_payments
- oracle:banking_platform
- oracle:banking_trade_finance
- oracle:banking_treasury_management
- oracle:business_intelligence
- oracle:communications_asap
- oracle:communications_billing_and_revenue_management
- oracle:communications_cloud_native_core_console
- oracle:communications_cloud_native_core_network_function_cloud_native_environment
- oracle:communications_cloud_native_core_network_repository_function
- oracle:communications_cloud_native_core_network_slice_selection_function
- oracle:communications_cloud_native_core_policy
- oracle:communications_cloud_native_core_security_edge_protection_proxy
- oracle:communications_cloud_native_core_service_communication_proxy
- oracle:communications_cloud_native_core_unified_data_repository
- oracle:communications_convergence
- oracle:communications_convergent_charging_controller
- oracle:communications_diameter_signaling_router
- oracle:communications_eagle_element_management_system
- oracle:communications_eagle_ftp_table_base_retrieval
- oracle:communications_element_manager
- oracle:communications_evolved_communications_application_server
- oracle:communications_interactive_session_recorder
- oracle:communications_ip_service_activator
- oracle:communications_messaging_server
- oracle:communications_network_charging_and_control
- oracle:communications_network_integrity
- oracle:communications_performance_intelligence_center
- oracle:communications_pricing_design_center
- oracle:communications_service_broker
- oracle:communications_services_gatekeeper
- oracle:communications_session_report_manager
- oracle:communications_session_route_manager
- oracle:communications_unified_inventory_management
- oracle:communications_user_data_repository
- oracle:communications_webrtc_session_controller
- oracle:data_integrator
- oracle:e-business_suite
- oracle:enterprise_manager_base_platform
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p6xc-xr62-6r2g | Maven | org.apache.logging.log4j:log4j-core | >=2.4.0 <2.12.3 | 2.12.3 |
| GHSA-p6xc-xr62-6r2g | Maven | org.apache.logging.log4j:log4j-core | >=2.13.0 <2.17.0 | 2.17.0 |
| GHSA-p6xc-xr62-6r2g | Maven | org.apache.logging.log4j:log4j-core | <2.3.1 | 2.3.1 |
| GHSA-p6xc-xr62-6r2g | Maven | org.ops4j.pax.logging:pax-logging-log4j2 | >=1.8.0 <1.9.2 | 1.9.2 |
| GHSA-p6xc-xr62-6r2g | Maven | org.ops4j.pax.logging:pax-logging-log4j2 | >=1.10.0 <1.10.9 | 1.10.9 |
| GHSA-p6xc-xr62-6r2g | Maven | org.ops4j.pax.logging:pax-logging-log4j2 | >=1.11.0 <1.11.12 | 1.11.12 |
| GHSA-p6xc-xr62-6r2g | Maven | org.ops4j.pax.logging:pax-logging-log4j2 | >=2.0.0 <2.0.13 | 2.0.13 |