Search for packages
| purl | pkg:maven/org.apache.logging.log4j/log4j-core@2.5 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2021-45046
|
Vulnerable Vulnerable Vulnerable Vulnerable |
|
|
CVE-2021-45105
|
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
|
CVE-2021-44228
|
Apache Log4j <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2021-44832
|
Vulnerable Vulnerable Vulnerable |
|
|
CVE-2017-5645
|
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log … |
Vulnerable |
|
GHSA-jfh8-c2jp-5v3q
Aliases: CVE-2021-44228 |
Remote code injection in Log4j # Summary Log4j versions prior to 2.16.0 are subject to a remote code execution vulnerability … |
Vulnerable |
|
GHSA-p6xc-xr62-6r2g
Aliases: CVE-2021-45105 |
Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) did not … |
Vulnerable |
|
GHSA-vc5p-v9hr-52mj
Aliases: CVE-2025-68161 |
Apache Log4j does not verify the TLS hostname in its Socket Appender The Socket Appender in Apache Log4j Core versions … |
Vulnerable |
|
GHSA-8489-44mv-ggj8
Aliases: CVE-2021-44832 |
Improper Input Validation and Injection in Apache Log4j2 Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and … |
Vulnerable |
|
GHSA-3pxv-7cmr-fjr4
Aliases: CVE-2026-34480 |
Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters Apache Log4j Core's [`XmlLayout`](https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout), … |
Not vulnerable |
|
GHSA-vwqq-5vrc-xw9h
Aliases: CVE-2020-9488 |
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender prior to version 2.13.2. This could allow an … |
Vulnerable |
|
GHSA-fxph-q3j8-mv87
Aliases: CVE-2017-5645 |
Deserialization of Untrusted Data in Log4j In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP … |
Vulnerable Vulnerable |
|
CVE-2021-44832
Aliases: GHSA-8489-44mv-ggj8 |
Improper Input Validation and Injection in Apache Log4j2 Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-7rjr-3q55-vv33
Aliases: CVE-2021-45046 |
Incomplete fix for Apache Log4j vulnerability # Impact The fix to address [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) in Apache Log4j 2.15.0 was incomplete in … |
Vulnerable Vulnerable |