Search for packages
| purl | pkg:maven/org.apache.logging.log4j/log4j-core@2.17.1 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-vc5p-v9hr-52mj
Aliases: CVE-2025-68161 |
Apache Log4j does not verify the TLS hostname in its Socket Appender The Socket Appender in Apache Log4j Core versions … |
Vulnerable |
|
GHSA-6hg6-v5c8-fphq
Aliases: CVE-2026-34477 |
Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration The fix for CVE-2025-68161 was incomplete: it addressed hostname verification … |
Not vulnerable |
|
GHSA-3pxv-7cmr-fjr4
Aliases: CVE-2026-34480 |
Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters Apache Log4j Core's [`XmlLayout`](https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout), … |
Not vulnerable |
|
GHSA-h383-gmxw-35v2
Aliases: CVE-2026-34479 |
Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters … |
Not vulnerable |
|
CVE-2026-34479
Aliases: GHSA-h383-gmxw-35v2 |
Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters … |
Not vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2021-45046
|
||
|
CVE-2021-45105
|
||
|
CVE-2021-44228
|
Apache Log4j <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and … | |
|
CVE-2021-44832
|
||
|
GHSA-8489-44mv-ggj8
|
Improper Input Validation and Injection in Apache Log4j2 Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and … |
CVE-2021-44832
|
|
CVE-2021-44832
|
Improper Input Validation and Injection in Apache Log4j2 Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and … |
GHSA-8489-44mv-ggj8
|