{"id":"CVE-2021-45105","published":"2021-12-18T11:55:08Z","modified":"2026-05-29T11:45:26Z","title":"Apache Log4j2 does not always protect from infinite recursion in lookup evaluation","vendor":"Apache Software Foundation","product":"Apache Log4j2","tier":"core","eol":null,"affectedVersions":[{"vendor":"Apache Software Foundation","product":"Apache Log4j2","versions":[">= log4j-core, < 2.17.0"]}],"description":{"text":"Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.","provenance":"source","from":"CVE.org"},"summary":{"text":"Apache Log4j2, in the Apache Software Foundation's logging library, does not protect against uncontrolled recursion caused by self-referential lookups in versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1). An attacker who can control Thread Context Map data can send a crafted string that, when interpreted, causes a denial of service.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:39Z"},"cvss":{"score":5.9,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.99999,"percentile":0.9999,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2021-12-22","exploitedFirstSeen":"2021-12-22","ransomware":true,"evidence":[{"url":"https://cisa.gov/news-events/alerts/2021/12/22/mitigating-log4shell-and-other-log4j-related-vulnerabilities","date":"2021-12-22"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa21-356a","date":"2021-12-23"},{"url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/cyber-year-in-retrospect/yir-cyber-threats-annex-download.pdf","date":"2022-04-26"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa22-257a","date":"2022-09-14"},{"url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state","date":"2022-10-13"},{"url":"https://info.securin.io/hubfs/Securin%20Ransomware%20Report%202023.pdf","date":"2023-02-14"},{"url":"https://ics-cert.kaspersky.com/publications/reports/2023/03/24/apt-attacks-on-industrial-organizations-in-h2-2022/","date":"2023-03-24"},{"url":"https://4502402.fs1.hubspotusercontent-na1.net/hubfs/4502402/Ransomware%20-%20Index%20Update%20Q1%202023.pdf","date":"2023-05-15"},{"url":"https://www.securin.io/wp-content/uploads/2023/08/2023-State-of-Cybersecurity-for-Medical-Devices-and-Healthcare-Systems.pdf","date":"2023-08-08"},{"url":"https://25491742.fs1.hubspotusercontent-eu1.net/hubfs/25491742/WAZAWAKA_TLPCLEAR_Report.pdf","date":"2023-12-20"}],"evidenceTotal":17,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Kwetsbaarheid Log4j versie 2.16 [Nationaal Cyber Security Centrum - Nieuwsberichten]","url":"https://otx.alienvault.com/pulse/6a6d444fef2f0f7298d70554","created":"2026-08-01"},{"name":"APT29","url":"https://otx.alienvault.com/pulse/69f46a108000bd36fe90d5be","created":"2026-05-01"},{"name":"dfirfanatic_IOC's","url":"https://otx.alienvault.com/pulse/67e4c1dd7b36e6d82df4d612","created":"2025-03-27"},{"name":"pulse2","url":"https://otx.alienvault.com/pulse/662edc10a9158fb6cbe169ee","created":"2024-04-28"},{"name":"Sąd Rejonowy w Jeleniej Gorze  POLAND","url":"https://otx.alienvault.com/pulse/66246ff49ed29ea9bb2bf122","created":"2024-04-21"},{"name":"MUI programu Microsoft Office Access (w języku angielskim) zostało użyte do wysłania złośliwego oprogramowania na serwer w Czechach jest to pierwszy tego typu atak na komputer.                     e","url":"https://otx.alienvault.com/pulse/6608aaf7ca0e965e593ed1d4","created":"2024-03-31"},{"name":"Smoke and Mirrors: Understanding The Workings of Wazawaka","url":"https://otx.alienvault.com/pulse/658aa57b6951aa256ac91991","created":"2023-12-26"},{"name":"Conti Ransomware (June 2022)","url":"https://otx.alienvault.com/pulse/65708fcf38f1bd5e40046c7a","created":"2023-12-06"},{"name":"CONTI ARMADA:THE ARMATTACKCAMPAIGN","url":"https://otx.alienvault.com/pulse/65708facb61096b6096093c1","created":"2023-12-06"},{"name":"CONTI ARMADA:THE ARMATTACKCAMPAIGN","url":"https://otx.alienvault.com/pulse/65708faaee010f81d3f9b3b2","created":"2023-12-06"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"},{"id":"CWE-674","name":"Uncontrolled Recursion"}],"references":[{"url":"https://logging.apache.org/log4j/2.x/security.html","tags":["x_refsource_MISC"]},{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032","tags":["x_refsource_CONFIRM"]},{"url":"https://www.kb.cert.org/vuls/id/930724","tags":["third-party-advisory","x_refsource_CERT-VN"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","tags":["vendor-advisory","x_refsource_CISCO"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/19/1","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.debian.org/security/2021/dsa-5024","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf","tags":["x_refsource_CONFIRM"]},{"url":"https://security.netapp.com/advisory/ntap-20211218-0001/","tags":["x_refsource_CONFIRM"]},{"url":"https://www.zerodayinitiative.com/advisories/ZDI-21-1541/","tags":["x_refsource_MISC"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf","tags":["x_refsource_CONFIRM"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC"]},{"url":"https://www.oracle.com/security-alerts/cpujul2022.html","tags":["x_refsource_MISC"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: remote attacker exploits public-facing logging library input","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"did not protect from uncontrolled recursion from self-referential lookups","start":78,"end":151}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1499.004","name":"Application or System Exploitation","tactics":["impact"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: crafted string causes application denial of service","mappingType":"primary_impact","evidence":[{"from":"description","quote":"cause a denial of service when a crafted string is interpreted","start":222,"end":284}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-e030a140d352155c7a50","title":"RaaS AvosLocker Incident Response Analysis","publisher":"linkedin.com","url":"https://www.linkedin.com/pulse/raas-avoslocker-incident-response-analysis-fl%C3%A1vio-costa?trk=articles_directory","date":null,"mentions":[{"quote":"vulnerabilities associated to Log4J were found on the VMWare Horizon Unified Access Gateways, UAG01 and UAG02, those were CVE-2021-44228 / CVE-2021-45046 / CVE-2021-45105 / CVE-2021-44832, which can potentially allow remote code execution on Unified Access Gateway by the low privilege non-root user named","start":2373,"end":2678}]}],"affected":[{"ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","vulnerableRanges":[">=2.4.0, <2.12.3",">=2.13.0, <2.17.0","<2.3.1"],"patched":["2.12.3","2.17.0","2.3.1"],"from":["GHSA-p6xc-xr62-6r2g"],"provenance":"source"},{"ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","vulnerableRanges":[">=1.8.0, <1.9.2",">=1.10.0, <1.10.9",">=1.11.0, <1.11.12",">=2.0.0, <2.0.13"],"patched":["1.9.2","1.10.9","1.11.12","2.0.13"],"from":["GHSA-p6xc-xr62-6r2g"],"provenance":"source"}],"advisories":[{"id":"GHSA-p6xc-xr62-6r2g","url":"https://github.com/advisories/GHSA-p6xc-xr62-6r2g","severity":"HIGH","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","vulnerableRanges":[">=2.4.0, <2.12.3"],"patched":["2.12.3"],"provenance":"source","from":"GHSA"},{"id":"GHSA-p6xc-xr62-6r2g","url":"https://github.com/advisories/GHSA-p6xc-xr62-6r2g","severity":"HIGH","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","vulnerableRanges":[">=2.13.0, <2.17.0"],"patched":["2.17.0"],"provenance":"source","from":"GHSA"},{"id":"GHSA-p6xc-xr62-6r2g","url":"https://github.com/advisories/GHSA-p6xc-xr62-6r2g","severity":"HIGH","ecosystem":"Maven","package":"org.apache.logging.log4j:log4j-core","vulnerableRanges":["<2.3.1"],"patched":["2.3.1"],"provenance":"source","from":"GHSA"},{"id":"GHSA-p6xc-xr62-6r2g","url":"https://github.com/advisories/GHSA-p6xc-xr62-6r2g","severity":"HIGH","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","vulnerableRanges":[">=1.8.0, <1.9.2"],"patched":["1.9.2"],"provenance":"source","from":"GHSA"},{"id":"GHSA-p6xc-xr62-6r2g","url":"https://github.com/advisories/GHSA-p6xc-xr62-6r2g","severity":"HIGH","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","vulnerableRanges":[">=1.10.0, <1.10.9"],"patched":["1.10.9"],"provenance":"source","from":"GHSA"},{"id":"GHSA-p6xc-xr62-6r2g","url":"https://github.com/advisories/GHSA-p6xc-xr62-6r2g","severity":"HIGH","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","vulnerableRanges":[">=1.11.0, <1.11.12"],"patched":["1.11.12"],"provenance":"source","from":"GHSA"},{"id":"GHSA-p6xc-xr62-6r2g","url":"https://github.com/advisories/GHSA-p6xc-xr62-6r2g","severity":"HIGH","ecosystem":"Maven","package":"org.ops4j.pax.logging:pax-logging-log4j2","vulnerableRanges":[">=2.0.0, <2.0.13"],"patched":["2.0.13"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2021-2559","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-2559","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":5,"skipped":2,"earliest":"2021-12-18","earliestUrl":"https://github.com/cckuailong/Log4j_dos_CVE-2021-45105","repos":[{"name":"cckuailong/Log4j_dos_CVE-2021-45105","url":"https://github.com/cckuailong/Log4j_dos_CVE-2021-45105","stars":13,"created":"2021-12-18"},{"name":"iAmSOScArEd/log4j2_dos_exploit","url":"https://github.com/iAmSOScArEd/log4j2_dos_exploit","stars":3,"created":"2021-12-20"},{"name":"name/log4j-remediation","url":"https://github.com/name/log4j-remediation","stars":1,"created":"2021-12-23"},{"name":"tejas-nagchandi/CVE-2021-45105","url":"https://github.com/tejas-nagchandi/CVE-2021-45105","stars":0,"created":"2021-12-19"},{"name":"aajuvonen/CVE-2021-45105-demo","url":"https://github.com/aajuvonen/CVE-2021-45105-demo","stars":0,"created":"2022-04-03"}]},"first":{"date":"2021-12-18","source":"PoC-in-GitHub","url":"https://github.com/cckuailong/Log4j_dos_CVE-2021-45105"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1499.004"],"provenance":"ai"}],"timeline":[{"date":"2021-12-18","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-45105","provenance":"source"},{"date":"2021-12-18","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/cckuailong/Log4j_dos_CVE-2021-45105","provenance":"source"},{"date":"2021-12-22","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cisa.gov/news-events/alerts/2021/12/22/mitigating-log4shell-and-other-log4j-related-vulnerabilities","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":81.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1772 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9999"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"5 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":4.13,"detail":"base score 5.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2020-9488","published":"2020-04-27","fixed":"2.13.2","kev":false},{"cve":"CVE-2021-44228","published":"2021-12-10","fixed":"2.15.0","kev":true},{"cve":"CVE-2021-45046","published":"2021-12-14","fixed":"2.16.0","kev":true,"link":{"from":"CVE-2021-45046","to":"CVE-2021-45105","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.logging.log4j:log4j-core","fromFixed":"2.12.2","toFixed":"2.12.3","daysApart":4},{"kind":"version-step","provenance":"source","package":"Maven:org.ops4j.pax.logging:pax-logging-log4j2","fromFixed":"1.10.8","toFixed":"1.10.9","daysApart":4},{"kind":"similar","provenance":"machine","score":0.23,"basis":"same product + description similarity"}]}},{"cve":"CVE-2021-45105","published":"2021-12-18","fixed":"2.17.0","kev":false},{"cve":"CVE-2021-44832","published":"2021-12-28","fixed":"2.17.1","kev":false,"link":{"from":"CVE-2021-45105","to":"CVE-2021-44832","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Maven:org.apache.logging.log4j:log4j-core","fromFixed":"2.3.1","toFixed":"2.3.2","daysApart":10},{"kind":"version-step","provenance":"source","package":"Maven:org.ops4j.pax.logging:pax-logging-log4j2","fromFixed":"1.11.12","toFixed":"1.11.13","daysApart":10},{"kind":"similar","provenance":"machine","score":0.3,"basis":"same product + CWE + description similarity"}]}},{"cve":"CVE-2025-68161","published":"2025-12-18","fixed":"2.25.3","kev":false},{"cve":"CVE-2026-34477","published":"2026-04-10","fixed":"2.25.4","kev":false}],"package":"Maven:org.apache.logging.log4j:log4j-core"}}