Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-aws-kinesis-agent | Jul 4, 2022 | Dec 18, 2021 | |
| Apache Log4j Core | — | apache-log4j-core-upgrade-2_12_3apache-log4j-core-upgrade-2_17apache-log4j-core-upgrade-2_3_1 | Dec 20, 2021 | Dec 17, 2021 |
| Apache Ofbiz | apache-ofbiz-upgrade-latest | Dec 23, 2024 | Dec 18, 2021 | |
| Debian | debian-upgrade-apache-log4j2 | Dec 20, 2021 | Dec 18, 2021 | |
| Freebsd | freebsd-upgrade-package-opensearch | Nov 4, 2022 | Dec 27, 2021 | |
| Ibm Was | ibm-was-upgrade-latest | Aug 26, 2022 | Dec 18, 2021 | |
| Red Hat Jboss Eap | red-hat-jboss-eap-upgrade-latest | Sep 19, 2024 | Dec 18, 2021 | |
| Sonicwall Email Security | sonicwall-email-security-upgrade-10013 | Sep 22, 2025 | Dec 11, 2021 | |
| Suse | — | suse-upgrade-log4jsuse-upgrade-log4j-javadocsuse-upgrade-log4j-jclsuse-upgrade-log4j-slf4j | Dec 21, 2021 | Dec 18, 2021 |
| Ubuntu | ubuntu-upgrade-liblog4j2-java | Dec 20, 2021 | Dec 18, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub