Staging Environment: Content and features may be unstable or change without notice.
Advisory details: github_osv / GHSA-p6xc-xr62-6r2g
Advisory ID github_osv/GHSA-p6xc-xr62-6r2g
Aliases CVE-2021-45105
Summary Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0 and 2.12.3. # Affected packages Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use.
Status Published
Exploitability 2.0
Weighted Severity 7.7
Risk 10.0
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (2)
CWE-20 Improper Input Validation
CWE-674 Uncontrolled Recursion
System Score Found at
cvssv3.1 8.6 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-p6xc-xr62-6r2g/GHSA-p6xc-xr62-6r2g.json
generic_textual HIGH
Reference id Reference type URL
https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf
https://lists.debian.org/debian-lts-announce/2021/12/msg00017.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
https://security.netapp.com/advisory/ntap-20211218-0001
https://www.debian.org/security/2021/dsa-5024
https://www.zerodayinitiative.com/advisories/ZDI-21-1541
http://www.openwall.com/lists/oss-security/2021/12/19/1
930724 Advisory https://www.kb.cert.org/vuls/id/930724
cisco-sa-apache-log4j-qRuKNEbd Advisory https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd
cpuapr2022.html Other https://www.oracle.com/security-alerts/cpuapr2022.html
cpujan2022.html Other https://www.oracle.com/security-alerts/cpujan2022.html
cpujul2022.html Other https://www.oracle.com/security-alerts/cpujul2022.html
CVE-2021-45105 https://nvd.nist.gov/vuln/detail/CVE-2021-45105
security.html Other https://logging.apache.org/log4j/2.x/security.html
SNWLID-2021-0032 Other https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
ssa-479842.pdf Other https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf
No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H Found at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-p6xc-xr62-6r2g/GHSA-p6xc-xr62-6r2g.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-05-29T11:45:21Z/

Decision: Track

Source URL: https://github.com/cisagov/vulnrichment/blob/develop/2021/45xxx/CVE-2021-45105.json

Source Advisory: vulnrichment/CVE-2021-45105

View SSVC decision tree 
[{'Exploitation': 'none'},
 {'Automatable': 'no'},
 {'Technical Impact': 'partial'},
 {'Mission Prevalence': 'minimal'},
 {'Public Well-being Impact': 'material'},
 {'Mission & Well-being': 'medium'}]