Apache Software Foundation Log4j

Name: Apache Software Foundation Log4j
Brand: Apache Software Foundation

productRU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

12critical8high2medium1low

updated 2026-10-28

vulnerabilities (23)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2021-44228US	critical10.0OT critical	100.0% (100th)	KEV	no fix	2021-12-10	3 versions
CVE-2021-45046US	critical9.0OT critical	100.0% (100th)	KEV	no fix	2021-12-14	2 versions
CVE-2021-45105US	medium5.9	100.0% (100th)	Exploit	no fix	2021-12-18	3 versions
CVE-2021-44832US	medium6.6	97.9% (100th)	Exploit	no fix	2021-12-28	3 versions
CVE-2017-5645US	critical9.8	89.4% (100th)	Exploit	no fix	2017-04-17	2.0 → 2.8.2
CVE-2021-4104US	high7.5	80.6% (100th)	Exploit	no fix	2021-12-14	≤ 1.2
CVE-2021-21345US	critical9.9	72.3% (99th)	Exploit	no fix	2021-03-23	≤ 5.17.0
CVE-2019-17571US	critical9.8	70.0% (99th)	Exploit	no fix	2019-12-20	2 versions
CVE-2022-23305US	critical9.8	66.5% (99th)	Exploit	no fix	2022-01-18	1.2.0 → 1.2.17
CVE-2021-21349US	high8.6	46.8% (99th)	Exploit	no fix	2021-03-23	≤ 5.17.0
CVE-2020-9488US	low3.7	8.22% (95th)	Exploit	no fix	2020-04-27	≤ 2.13.2
CVE-2021-21351US	critical9.1	82.1% (100th)	—	no fix	2021-03-23	≤ 5.17.0
CVE-2021-21346US	critical9.8	76.4% (100th)	—	no fix	2021-03-23	≤ 5.17.0
CVE-2021-21344US	critical9.8	76.0% (100th)	—	no fix	2021-03-23	≤ 5.17.0
CVE-2022-23302US	high8.8	63.8% (99th)	—	no fix	2022-01-18	1.0 → 2.0
CVE-2022-23307US	high8.8	54.4% (99th)	—	no fix	2022-01-18	≤ 2.0
CVE-2021-21342US	critical9.1	50.0% (99th)	—	no fix	2021-03-23	≤ 5.17.0
CVE-2021-21350US	critical9.8	15.2% (97th)	—	no fix	2021-03-23	≤ 5.17.0
CVE-2021-21347US	critical9.8	14.3% (97th)	—	no fix	2021-03-23	≤ 5.17.0
CVE-2021-21348US	high7.5	13.8% (97th)	—	no fix	2021-03-23	≤ 5.17.0
CVE-2023-26464US	high7.5	1.91% (80th)	—	no fix	2023-03-10	1.0.4 → 2.0
CVE-2022-0070US	high8.8	0.38% (32nd)	—	no fix	2022-04-19	≤ 1.1-16
CVE-2021-3100US	high8.8	0.37% (30th)	—	no fix	2022-04-19	≤ 1.1-12

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-502Deserialization of Untrusted Data17 CVEs
CWE-20Improper Input Validation6 CVEs
CWE-434Unrestricted Upload of File with Dangerous Type5 CVEs
CWE-400Uncontrolled Resource Consumption3 CVEs
CWE-250Execution with Unnecessary Privileges2 CVEs
CWE-269Improper Privilege Management2 CVEs
CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')2 CVEs
CWE-918Server-Side Request Forgery (SSRF)2 CVEs

sources (2)

Which sources assert this record, and when.

RUBDU (FSTEC Data Security Threats Database)23 CVEs
EUEU Vulnerability Database (ENISA)1 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan