critical vulnerability

Incomplete fix for Apache Log4j vulnerability

Exploited · CISA KEVFix availableCritical · CVSS 9EPSS 100.0%

Published Dec 14, 2021 · updated Oct 2, 2026 · added to CISA KEV May 1, 2023

What to do

Upgrade to a fixed version: org.apache.logging.log4j:log4j-core 2.16.0, org.ops4j.pax.logging:pax-logging-log4j2 1.9.2, org.ops4j.pax.logging:pax-logging-log4j2 1.10.8, org.ops4j.pax.logging:pax-logging-log4j2 1.11.11 (see table).
This is exploited in the wild: treat it as urgent (CISA's federal deadline is May 22, 2023).
Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Mavenorg.apache.logging.log4j:log4j-core

Vulnerable versions: >= 2.13.0, < 2.16.0
Fixed in: 2.16.0

Check your project: mvn dependency:tree -Dincludes=org.apache.logging.log4j:log4j-core

Mavenorg.ops4j.pax.logging:pax-logging-log4j2

Vulnerable versions: >= 1.8.0, < 1.9.2
Fixed in: 1.9.2

Check your project: mvn dependency:tree -Dincludes=org.ops4j.pax.logging:pax-logging-log4j2

Mavenorg.ops4j.pax.logging:pax-logging-log4j2

Vulnerable versions: >= 1.10.0, < 1.10.8
Fixed in: 1.10.8

Check your project: mvn dependency:tree -Dincludes=org.ops4j.pax.logging:pax-logging-log4j2

Mavenorg.ops4j.pax.logging:pax-logging-log4j2

Vulnerable versions: >= 1.11.0, < 1.11.11
Fixed in: 1.11.11

Check your project: mvn dependency:tree -Dincludes=org.ops4j.pax.logging:pax-logging-log4j2

Mavenorg.ops4j.pax.logging:pax-logging-log4j2

Vulnerable versions: >= 2.0.0, < 2.0.12
Fixed in: 2.0.12

Check your project: mvn dependency:tree -Dincludes=org.ops4j.pax.logging:pax-logging-log4j2

Mavenorg.apache.logging.log4j:log4j-core

Vulnerable versions: >= 2.4.0, < 2.12.2
Fixed in: 2.12.2

Check your project: mvn dependency:tree -Dincludes=org.apache.logging.log4j:log4j-core

Mavenorg.apache.logging.log4j:log4j-core

Vulnerable versions: < 2.3.1
Fixed in: 2.3.1

Check your project: mvn dependency:tree -Dincludes=org.apache.logging.log4j:log4j-core

What changed

May 1, 2023
Added to CISA KEV on 2023-05-01: exploitation in the wild confirmed; federal remediation due 2023-05-22.

Sources

CWE-502 Deserialization of Untrusted Data · CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

← All critical vulnerabilities