{"schema_version":"2","view":"grouped","data":[{"id":70977,"cve_ids":["CVE-2021-45046"],"payload":{"kind":"advisory","title":"Incomplete fix for Apache Log4j vulnerability","summary":"# Impact The fix to address [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allow attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a remote code execution (RCE) attack. ## Affected packages Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use. # Mitigation Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default. This issue can be mitigated in prior releases (< 2.16.0) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as to set the system property `log4j2.formatMsgNoLookups` to `true` do NOT mitigate this specific vulnerability.","evidence":"osv:GHSA-7rjr-3q55-vv33","products":[{"name":{"value":"org.apache.logging.log4j:log4j-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.16.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.13.0","evidence":"/affected/0/versions"},{"value":"2.13.1","evidence":"/affected/0/versions"},{"value":"2.13.2","evidence":"/affected/0/versions"},{"value":"2.13.3","evidence":"/affected/0/versions"},{"value":"2.14.0","evidence":"/affected/0/versions"},{"value":"2.14.1","evidence":"/affected/0/versions"},{"value":"2.15.0","evidence":"/affected/0/versions"}]},{"name":{"value":"org.apache.logging.log4j:log4j-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.12.2","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.10.0","evidence":"/affected/1/versions"},{"value":"2.11.0","evidence":"/affected/1/versions"},{"value":"2.11.1","evidence":"/affected/1/versions"},{"value":"2.11.2","evidence":"/affected/1/versions"},{"value":"2.12.0","evidence":"/affected/1/versions"},{"value":"2.12.1","evidence":"/affected/1/versions"},{"value":"2.4","evidence":"/affected/1/versions"},{"value":"2.4.1","evidence":"/affected/1/versions"},{"value":"2.5","evidence":"/affected/1/versions"},{"value":"2.6","evidence":"/affected/1/versions"},{"value":"2.6.1","evidence":"/affected/1/versions"},{"value":"2.6.2","evidence":"/affected/1/versions"},{"value":"2.7","evidence":"/affected/1/versions"},{"value":"2.8","evidence":"/affected/1/versions"},{"value":"2.8.1","evidence":"/affected/1/versions"},{"value":"2.8.2","evidence":"/affected/1/versions"},{"value":"2.9.0","evidence":"/affected/1/versions"},{"value":"2.9.1","evidence":"/affected/1/versions"}]},{"name":{"value":"org.ops4j.pax.logging:pax-logging-log4j2","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.9.2","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"1.8.0","evidence":"/affected/2/versions"},{"value":"1.8.1","evidence":"/affected/2/versions"},{"value":"1.8.2","evidence":"/affected/2/versions"},{"value":"1.8.3","evidence":"/affected/2/versions"},{"value":"1.8.4","evidence":"/affected/2/versions"},{"value":"1.8.5","evidence":"/affected/2/versions"},{"value":"1.8.6","evidence":"/affected/2/versions"},{"value":"1.8.7","evidence":"/affected/2/versions"},{"value":"1.9.0","evidence":"/affected/2/versions"},{"value":"1.9.1","evidence":"/affected/2/versions"}]},{"name":{"value":"org.ops4j.pax.logging:pax-logging-log4j2","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.10.8","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"1.10.0","evidence":"/affected/3/versions"},{"value":"1.10.1","evidence":"/affected/3/versions"},{"value":"1.10.2","evidence":"/affected/3/versions"},{"value":"1.10.3","evidence":"/affected/3/versions"},{"value":"1.10.4","evidence":"/affected/3/versions"},{"value":"1.10.5","evidence":"/affected/3/versions"},{"value":"1.10.6","evidence":"/affected/3/versions"},{"value":"1.10.7","evidence":"/affected/3/versions"}]},{"name":{"value":"org.ops4j.pax.logging:pax-logging-log4j2","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.11.11","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"1.11.0","evidence":"/affected/4/versions"},{"value":"1.11.1","evidence":"/affected/4/versions"},{"value":"1.11.10","evidence":"/affected/4/versions"},{"value":"1.11.2","evidence":"/affected/4/versions"},{"value":"1.11.3","evidence":"/affected/4/versions"},{"value":"1.11.4","evidence":"/affected/4/versions"},{"value":"1.11.5","evidence":"/affected/4/versions"},{"value":"1.11.6","evidence":"/affected/4/versions"},{"value":"1.11.7","evidence":"/affected/4/versions"},{"value":"1.11.8","evidence":"/affected/4/versions"},{"value":"1.11.9","evidence":"/affected/4/versions"}]},{"name":{"value":"org.ops4j.pax.logging:pax-logging-log4j2","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.0.12","evidence":"/affected/5/ranges"}],"affected_versions":[{"value":"2.0.0","evidence":"/affected/5/versions"},{"value":"2.0.1","evidence":"/affected/5/versions"},{"value":"2.0.10","evidence":"/affected/5/versions"},{"value":"2.0.11","evidence":"/affected/5/versions"},{"value":"2.0.2","evidence":"/affected/5/versions"},{"value":"2.0.3","evidence":"/affected/5/versions"},{"value":"2.0.4","evidence":"/affected/5/versions"},{"value":"2.0.5","evidence":"/affected/5/versions"},{"value":"2.0.6","evidence":"/affected/5/versions"},{"value":"2.0.7","evidence":"/affected/5/versions"},{"value":"2.0.8","evidence":"/affected/5/versions"},{"value":"2.0.9","evidence":"/affected/5/versions"}]},{"name":{"value":"org.apache.logging.log4j:log4j-core","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.3.1","evidence":"/affected/6/ranges"}],"affected_versions":[{"value":"2.0","evidence":"/affected/6/versions"},{"value":"2.0-alpha1","evidence":"/affected/6/versions"},{"value":"2.0-alpha2","evidence":"/affected/6/versions"},{"value":"2.0-beta1","evidence":"/affected/6/versions"},{"value":"2.0-beta2","evidence":"/affected/6/versions"},{"value":"2.0-beta3","evidence":"/affected/6/versions"},{"value":"2.0-beta4","evidence":"/affected/6/versions"},{"value":"2.0-beta5","evidence":"/affected/6/versions"},{"value":"2.0-beta6","evidence":"/affected/6/versions"},{"value":"2.0-beta7","evidence":"/affected/6/versions"},{"value":"2.0-beta8","evidence":"/affected/6/versions"},{"value":"2.0-beta9","evidence":"/affected/6/versions"},{"value":"2.0-rc1","evidence":"/affected/6/versions"},{"value":"2.0-rc2","evidence":"/affected/6/versions"},{"value":"2.0.1","evidence":"/affected/6/versions"},{"value":"2.0.2","evidence":"/affected/6/versions"},{"value":"2.1","evidence":"/affected/6/versions"},{"value":"2.2","evidence":"/affected/6/versions"},{"value":"2.3","evidence":"/affected/6/versions"}]}],"severity":"critical","structured":{"id":"GHSA-7rjr-3q55-vv33","aliases":["CVE-2021-45046","GHSA-7rjr-3q55-vv33"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.0"},{"fixed":"2.16.0"}]}],"package":{"name":"org.apache.logging.log4j:log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core","ecosystem":"Maven"},"versions":["2.13.0","2.13.1","2.13.2","2.13.3","2.14.0","2.14.1","2.15.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.12.2"}]}],"package":{"name":"org.apache.logging.log4j:log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core","ecosystem":"Maven"},"versions":["2.10.0","2.11.0","2.11.1","2.11.2","2.12.0","2.12.1","2.4","2.4.1","2.5","2.6","2.6.1","2.6.2","2.7","2.8","2.8.1","2.8.2","2.9.0","2.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"fixed":"1.9.2"}]}],"package":{"name":"org.ops4j.pax.logging:pax-logging-log4j2","purl":"pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2","ecosystem":"Maven"},"versions":["1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.9.0","1.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.10.8"}]}],"package":{"name":"org.ops4j.pax.logging:pax-logging-log4j2","purl":"pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2","ecosystem":"Maven"},"versions":["1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.0"},{"fixed":"1.11.11"}]}],"package":{"name":"org.ops4j.pax.logging:pax-logging-log4j2","purl":"pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2","ecosystem":"Maven"},"versions":["1.11.0","1.11.1","1.11.10","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.11.8","1.11.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.12"}]}],"package":{"name":"org.ops4j.pax.logging:pax-logging-log4j2","purl":"pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2","ecosystem":"Maven"},"versions":["2.0.0","2.0.1","2.0.10","2.0.11","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1"}]}],"package":{"name":"org.apache.logging.log4j:log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core","ecosystem":"Maven"},"versions":["2.0","2.0-alpha1","2.0-alpha2","2.0-beta1","2.0-beta2","2.0-beta3","2.0-beta4","2.0-beta5","2.0-beta6","2.0-beta7","2.0-beta8","2.0-beta9","2.0-rc1","2.0-rc2","2.0.1","2.0.2","2.1","2.2","2.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"}}],"modified":"2026-10-02T20:30:05.438504645Z","provider":"osv","references":["https://nvd.nist.gov/vuln/detail/CVE-2021-45046","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/alert-cve-2021-44228.html","https://www.openwall.com/lists/oss-security/2021/12/18/1","https://www.openwall.com/lists/oss-security/2021/12/15/3","https://www.openwall.com/lists/oss-security/2021/12/14/4","https://www.kb.cert.org/vuls/id/930724","https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html","https://www.debian.org/security/2021/dsa-5022","https://www.cve.org/CVERecord?id=CVE-2021-44228","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-45046","https://security.gentoo.org/glsa/202310-16","https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032","https://logging.apache.org/security.html#CVE-2021-45046","https://logging.apache.org/log4j/2.x/security.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY","https://github.com/apache/logging-log4j2/compare/rel/2.3...rel/2.3.1","https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf"],"provider_metadata":{"cwe_ids":["CWE-502","CWE-917"],"severity":"CRITICAL","github_reviewed":true,"nvd_published_at":"2021-12-14T19:15:00Z","github_reviewed_at":"2021-12-14T17:55:00Z"}},"related_cves":[{"value":"CVE-2021-45046","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"osv:GHSA-7rjr-3q55-vv33","priority":{"reasons":["publisher_severity","known_exploited"],"severity":"critical","linked_cves":[{"cve":"CVE-2021-45046","metrics":[],"products":[{"name":{"value":"Log4j2","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-45046","relationship":"advisory","known_exploited":true,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":true,"publisher_severity":"critical"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-7rjr-3q55-vv33","advisory_id":"725df016-b7b0-4081-9f5a-91206a3c647e","event_types":["advisory"],"published_at":"2026-10-25T22:46:02.756476+00:00","technologies":["core-osv","org-apache-logging-log4j-log4j-core","org-ops4j-pax-logging-pax-logging-log4j2"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-12-14T18:01:28+00:00","detail_url":"/advisories/osv%3AGHSA-7rjr-3q55-vv33","group":{"id":"osv:GHSA-7rjr-3q55-vv33","revision":1,"primary_event_id":71350,"change":"published","superseded_by":[],"changed":{"id":71350,"cve_ids":["CVE-2021-45046"],"payload":{"kind":"advisory","title":"Incomplete fix for Apache Log4j vulnerability","summary":"# Impact The fix to address [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allow attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a remote code execution (RCE) attack. ## Affected packages Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use. # Mitigation Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default. This issue can be mitigated in prior releases (< 2.16.0) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as to set the system property `log4j2.formatMsgNoLookups` to `true` do NOT mitigate this specific vulnerability.","evidence":"osv:GHSA-7rjr-3q55-vv33","products":[{"name":{"value":"org.apache.logging.log4j:log4j-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.16.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.13.0","evidence":"/affected/0/versions"},{"value":"2.13.1","evidence":"/affected/0/versions"},{"value":"2.13.2","evidence":"/affected/0/versions"},{"value":"2.13.3","evidence":"/affected/0/versions"},{"value":"2.14.0","evidence":"/affected/0/versions"},{"value":"2.14.1","evidence":"/affected/0/versions"},{"value":"2.15.0","evidence":"/affected/0/versions"}]},{"name":{"value":"org.apache.logging.log4j:log4j-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.12.2","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.10.0","evidence":"/affected/1/versions"},{"value":"2.11.0","evidence":"/affected/1/versions"},{"value":"2.11.1","evidence":"/affected/1/versions"},{"value":"2.11.2","evidence":"/affected/1/versions"},{"value":"2.12.0","evidence":"/affected/1/versions"},{"value":"2.12.1","evidence":"/affected/1/versions"},{"value":"2.4","evidence":"/affected/1/versions"},{"value":"2.4.1","evidence":"/affected/1/versions"},{"value":"2.5","evidence":"/affected/1/versions"},{"value":"2.6","evidence":"/affected/1/versions"},{"value":"2.6.1","evidence":"/affected/1/versions"},{"value":"2.6.2","evidence":"/affected/1/versions"},{"value":"2.7","evidence":"/affected/1/versions"},{"value":"2.8","evidence":"/affected/1/versions"},{"value":"2.8.1","evidence":"/affected/1/versions"},{"value":"2.8.2","evidence":"/affected/1/versions"},{"value":"2.9.0","evidence":"/affected/1/versions"},{"value":"2.9.1","evidence":"/affected/1/versions"}]},{"name":{"value":"org.ops4j.pax.logging:pax-logging-log4j2","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.9.2","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"1.8.0","evidence":"/affected/2/versions"},{"value":"1.8.1","evidence":"/affected/2/versions"},{"value":"1.8.2","evidence":"/affected/2/versions"},{"value":"1.8.3","evidence":"/affected/2/versions"},{"value":"1.8.4","evidence":"/affected/2/versions"},{"value":"1.8.5","evidence":"/affected/2/versions"},{"value":"1.8.6","evidence":"/affected/2/versions"},{"value":"1.8.7","evidence":"/affected/2/versions"},{"value":"1.9.0","evidence":"/affected/2/versions"},{"value":"1.9.1","evidence":"/affected/2/versions"}]},{"name":{"value":"org.ops4j.pax.logging:pax-logging-log4j2","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.10.8","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"1.10.0","evidence":"/affected/3/versions"},{"value":"1.10.1","evidence":"/affected/3/versions"},{"value":"1.10.2","evidence":"/affected/3/versions"},{"value":"1.10.3","evidence":"/affected/3/versions"},{"value":"1.10.4","evidence":"/affected/3/versions"},{"value":"1.10.5","evidence":"/affected/3/versions"},{"value":"1.10.6","evidence":"/affected/3/versions"},{"value":"1.10.7","evidence":"/affected/3/versions"}]},{"name":{"value":"org.ops4j.pax.logging:pax-logging-log4j2","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.11.11","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"1.11.0","evidence":"/affected/4/versions"},{"value":"1.11.1","evidence":"/affected/4/versions"},{"value":"1.11.10","evidence":"/affected/4/versions"},{"value":"1.11.2","evidence":"/affected/4/versions"},{"value":"1.11.3","evidence":"/affected/4/versions"},{"value":"1.11.4","evidence":"/affected/4/versions"},{"value":"1.11.5","evidence":"/affected/4/versions"},{"value":"1.11.6","evidence":"/affected/4/versions"},{"value":"1.11.7","evidence":"/affected/4/versions"},{"value":"1.11.8","evidence":"/affected/4/versions"},{"value":"1.11.9","evidence":"/affected/4/versions"}]},{"name":{"value":"org.ops4j.pax.logging:pax-logging-log4j2","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.0.12","evidence":"/affected/5/ranges"}],"affected_versions":[{"value":"2.0.0","evidence":"/affected/5/versions"},{"value":"2.0.1","evidence":"/affected/5/versions"},{"value":"2.0.10","evidence":"/affected/5/versions"},{"value":"2.0.11","evidence":"/affected/5/versions"},{"value":"2.0.2","evidence":"/affected/5/versions"},{"value":"2.0.3","evidence":"/affected/5/versions"},{"value":"2.0.4","evidence":"/affected/5/versions"},{"value":"2.0.5","evidence":"/affected/5/versions"},{"value":"2.0.6","evidence":"/affected/5/versions"},{"value":"2.0.7","evidence":"/affected/5/versions"},{"value":"2.0.8","evidence":"/affected/5/versions"},{"value":"2.0.9","evidence":"/affected/5/versions"}]},{"name":{"value":"org.apache.logging.log4j:log4j-core","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.3.1","evidence":"/affected/6/ranges"}],"affected_versions":[{"value":"2.0","evidence":"/affected/6/versions"},{"value":"2.0-alpha1","evidence":"/affected/6/versions"},{"value":"2.0-alpha2","evidence":"/affected/6/versions"},{"value":"2.0-beta1","evidence":"/affected/6/versions"},{"value":"2.0-beta2","evidence":"/affected/6/versions"},{"value":"2.0-beta3","evidence":"/affected/6/versions"},{"value":"2.0-beta4","evidence":"/affected/6/versions"},{"value":"2.0-beta5","evidence":"/affected/6/versions"},{"value":"2.0-beta6","evidence":"/affected/6/versions"},{"value":"2.0-beta7","evidence":"/affected/6/versions"},{"value":"2.0-beta8","evidence":"/affected/6/versions"},{"value":"2.0-beta9","evidence":"/affected/6/versions"},{"value":"2.0-rc1","evidence":"/affected/6/versions"},{"value":"2.0-rc2","evidence":"/affected/6/versions"},{"value":"2.0.1","evidence":"/affected/6/versions"},{"value":"2.0.2","evidence":"/affected/6/versions"},{"value":"2.1","evidence":"/affected/6/versions"},{"value":"2.2","evidence":"/affected/6/versions"},{"value":"2.3","evidence":"/affected/6/versions"}]}],"severity":"critical","structured":{"id":"GHSA-7rjr-3q55-vv33","aliases":["CVE-2021-45046","GHSA-7rjr-3q55-vv33"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.0"},{"fixed":"2.16.0"}]}],"package":{"name":"org.apache.logging.log4j:log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core","ecosystem":"Maven"},"versions":["2.13.0","2.13.1","2.13.2","2.13.3","2.14.0","2.14.1","2.15.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.12.2"}]}],"package":{"name":"org.apache.logging.log4j:log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core","ecosystem":"Maven"},"versions":["2.10.0","2.11.0","2.11.1","2.11.2","2.12.0","2.12.1","2.4","2.4.1","2.5","2.6","2.6.1","2.6.2","2.7","2.8","2.8.1","2.8.2","2.9.0","2.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"fixed":"1.9.2"}]}],"package":{"name":"org.ops4j.pax.logging:pax-logging-log4j2","purl":"pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2","ecosystem":"Maven"},"versions":["1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.9.0","1.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.10.8"}]}],"package":{"name":"org.ops4j.pax.logging:pax-logging-log4j2","purl":"pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2","ecosystem":"Maven"},"versions":["1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.0"},{"fixed":"1.11.11"}]}],"package":{"name":"org.ops4j.pax.logging:pax-logging-log4j2","purl":"pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2","ecosystem":"Maven"},"versions":["1.11.0","1.11.1","1.11.10","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.11.8","1.11.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.12"}]}],"package":{"name":"org.ops4j.pax.logging:pax-logging-log4j2","purl":"pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2","ecosystem":"Maven"},"versions":["2.0.0","2.0.1","2.0.10","2.0.11","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1"}]}],"package":{"name":"org.apache.logging.log4j:log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core","ecosystem":"Maven"},"versions":["2.0","2.0-alpha1","2.0-alpha2","2.0-beta1","2.0-beta2","2.0-beta3","2.0-beta4","2.0-beta5","2.0-beta6","2.0-beta7","2.0-beta8","2.0-beta9","2.0-rc1","2.0-rc2","2.0.1","2.0.2","2.1","2.2","2.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"}}],"modified":"2026-10-02T20:30:05.438504645Z","provider":"osv","references":["https://nvd.nist.gov/vuln/detail/CVE-2021-45046","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/alert-cve-2021-44228.html","https://www.openwall.com/lists/oss-security/2021/12/18/1","https://www.openwall.com/lists/oss-security/2021/12/15/3","https://www.openwall.com/lists/oss-security/2021/12/14/4","https://www.kb.cert.org/vuls/id/930724","https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html","https://www.debian.org/security/2021/dsa-5022","https://www.cve.org/CVERecord?id=CVE-2021-44228","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-45046","https://security.gentoo.org/glsa/202310-16","https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032","https://logging.apache.org/security.html#CVE-2021-45046","https://logging.apache.org/log4j/2.x/security.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY","https://github.com/apache/logging-log4j2/compare/rel/2.3...rel/2.3.1","https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf"],"provider_metadata":{"cwe_ids":["CWE-502","CWE-917"],"severity":"CRITICAL","github_reviewed":true,"nvd_published_at":"2021-12-14T19:15:00Z","github_reviewed_at":"2021-12-14T17:55:00Z"}},"related_cves":[{"value":"CVE-2021-45046","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"osv:GHSA-7rjr-3q55-vv33","priority":{"reasons":["publisher_severity","known_exploited"],"severity":"critical","linked_cves":[{"cve":"CVE-2021-45046","metrics":[],"products":[{"name":{"value":"Log4j2","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-45046","relationship":"advisory","known_exploited":true,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":true,"publisher_severity":"critical"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-7rjr-3q55-vv33","advisory_id":"725df016-b7b0-4081-9f5a-91206a3c647e","event_types":["advisory"],"published_at":"2026-10-25T22:46:02.756476+00:00","technologies":["core-osv","org-apache-logging-log4j-log4j-core","org-ops4j-pax-logging-pax-logging-log4j2"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-12-14T18:01:28+00:00","detail_url":"/events/71350"},"members":[{"id":71350,"cve_ids":["CVE-2021-45046"],"payload":{"kind":"advisory","title":"Incomplete fix for Apache Log4j vulnerability","summary":"# Impact The fix to address [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allow attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in a remote code execution (RCE) attack. ## Affected packages Only the `org.apache.logging.log4j:log4j-core` package is directly affected by this vulnerability. The `org.apache.logging.log4j:log4j-api` should be kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatability if in use. # Mitigation Log4j 2.16.0 fixes this issue by removing support for message lookup patterns and disabling JNDI functionality by default. This issue can be mitigated in prior releases (< 2.16.0) by removing the JndiLookup class from the classpath (example: zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class). Log4j 2.15.0 restricts JNDI LDAP lookups to localhost by default. Note that previous mitigations involving configuration such as to set the system property `log4j2.formatMsgNoLookups` to `true` do NOT mitigate this specific vulnerability.","evidence":"osv:GHSA-7rjr-3q55-vv33","products":[{"name":{"value":"org.apache.logging.log4j:log4j-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.16.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.13.0","evidence":"/affected/0/versions"},{"value":"2.13.1","evidence":"/affected/0/versions"},{"value":"2.13.2","evidence":"/affected/0/versions"},{"value":"2.13.3","evidence":"/affected/0/versions"},{"value":"2.14.0","evidence":"/affected/0/versions"},{"value":"2.14.1","evidence":"/affected/0/versions"},{"value":"2.15.0","evidence":"/affected/0/versions"}]},{"name":{"value":"org.apache.logging.log4j:log4j-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.12.2","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.10.0","evidence":"/affected/1/versions"},{"value":"2.11.0","evidence":"/affected/1/versions"},{"value":"2.11.1","evidence":"/affected/1/versions"},{"value":"2.11.2","evidence":"/affected/1/versions"},{"value":"2.12.0","evidence":"/affected/1/versions"},{"value":"2.12.1","evidence":"/affected/1/versions"},{"value":"2.4","evidence":"/affected/1/versions"},{"value":"2.4.1","evidence":"/affected/1/versions"},{"value":"2.5","evidence":"/affected/1/versions"},{"value":"2.6","evidence":"/affected/1/versions"},{"value":"2.6.1","evidence":"/affected/1/versions"},{"value":"2.6.2","evidence":"/affected/1/versions"},{"value":"2.7","evidence":"/affected/1/versions"},{"value":"2.8","evidence":"/affected/1/versions"},{"value":"2.8.1","evidence":"/affected/1/versions"},{"value":"2.8.2","evidence":"/affected/1/versions"},{"value":"2.9.0","evidence":"/affected/1/versions"},{"value":"2.9.1","evidence":"/affected/1/versions"}]},{"name":{"value":"org.ops4j.pax.logging:pax-logging-log4j2","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.9.2","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"1.8.0","evidence":"/affected/2/versions"},{"value":"1.8.1","evidence":"/affected/2/versions"},{"value":"1.8.2","evidence":"/affected/2/versions"},{"value":"1.8.3","evidence":"/affected/2/versions"},{"value":"1.8.4","evidence":"/affected/2/versions"},{"value":"1.8.5","evidence":"/affected/2/versions"},{"value":"1.8.6","evidence":"/affected/2/versions"},{"value":"1.8.7","evidence":"/affected/2/versions"},{"value":"1.9.0","evidence":"/affected/2/versions"},{"value":"1.9.1","evidence":"/affected/2/versions"}]},{"name":{"value":"org.ops4j.pax.logging:pax-logging-log4j2","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.10.8","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"1.10.0","evidence":"/affected/3/versions"},{"value":"1.10.1","evidence":"/affected/3/versions"},{"value":"1.10.2","evidence":"/affected/3/versions"},{"value":"1.10.3","evidence":"/affected/3/versions"},{"value":"1.10.4","evidence":"/affected/3/versions"},{"value":"1.10.5","evidence":"/affected/3/versions"},{"value":"1.10.6","evidence":"/affected/3/versions"},{"value":"1.10.7","evidence":"/affected/3/versions"}]},{"name":{"value":"org.ops4j.pax.logging:pax-logging-log4j2","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.11.11","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"1.11.0","evidence":"/affected/4/versions"},{"value":"1.11.1","evidence":"/affected/4/versions"},{"value":"1.11.10","evidence":"/affected/4/versions"},{"value":"1.11.2","evidence":"/affected/4/versions"},{"value":"1.11.3","evidence":"/affected/4/versions"},{"value":"1.11.4","evidence":"/affected/4/versions"},{"value":"1.11.5","evidence":"/affected/4/versions"},{"value":"1.11.6","evidence":"/affected/4/versions"},{"value":"1.11.7","evidence":"/affected/4/versions"},{"value":"1.11.8","evidence":"/affected/4/versions"},{"value":"1.11.9","evidence":"/affected/4/versions"}]},{"name":{"value":"org.ops4j.pax.logging:pax-logging-log4j2","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.0.12","evidence":"/affected/5/ranges"}],"affected_versions":[{"value":"2.0.0","evidence":"/affected/5/versions"},{"value":"2.0.1","evidence":"/affected/5/versions"},{"value":"2.0.10","evidence":"/affected/5/versions"},{"value":"2.0.11","evidence":"/affected/5/versions"},{"value":"2.0.2","evidence":"/affected/5/versions"},{"value":"2.0.3","evidence":"/affected/5/versions"},{"value":"2.0.4","evidence":"/affected/5/versions"},{"value":"2.0.5","evidence":"/affected/5/versions"},{"value":"2.0.6","evidence":"/affected/5/versions"},{"value":"2.0.7","evidence":"/affected/5/versions"},{"value":"2.0.8","evidence":"/affected/5/versions"},{"value":"2.0.9","evidence":"/affected/5/versions"}]},{"name":{"value":"org.apache.logging.log4j:log4j-core","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.3.1","evidence":"/affected/6/ranges"}],"affected_versions":[{"value":"2.0","evidence":"/affected/6/versions"},{"value":"2.0-alpha1","evidence":"/affected/6/versions"},{"value":"2.0-alpha2","evidence":"/affected/6/versions"},{"value":"2.0-beta1","evidence":"/affected/6/versions"},{"value":"2.0-beta2","evidence":"/affected/6/versions"},{"value":"2.0-beta3","evidence":"/affected/6/versions"},{"value":"2.0-beta4","evidence":"/affected/6/versions"},{"value":"2.0-beta5","evidence":"/affected/6/versions"},{"value":"2.0-beta6","evidence":"/affected/6/versions"},{"value":"2.0-beta7","evidence":"/affected/6/versions"},{"value":"2.0-beta8","evidence":"/affected/6/versions"},{"value":"2.0-beta9","evidence":"/affected/6/versions"},{"value":"2.0-rc1","evidence":"/affected/6/versions"},{"value":"2.0-rc2","evidence":"/affected/6/versions"},{"value":"2.0.1","evidence":"/affected/6/versions"},{"value":"2.0.2","evidence":"/affected/6/versions"},{"value":"2.1","evidence":"/affected/6/versions"},{"value":"2.2","evidence":"/affected/6/versions"},{"value":"2.3","evidence":"/affected/6/versions"}]}],"severity":"critical","structured":{"id":"GHSA-7rjr-3q55-vv33","aliases":["CVE-2021-45046","GHSA-7rjr-3q55-vv33"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.13.0"},{"fixed":"2.16.0"}]}],"package":{"name":"org.apache.logging.log4j:log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core","ecosystem":"Maven"},"versions":["2.13.0","2.13.1","2.13.2","2.13.3","2.14.0","2.14.1","2.15.0"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.12.2"}]}],"package":{"name":"org.apache.logging.log4j:log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core","ecosystem":"Maven"},"versions":["2.10.0","2.11.0","2.11.1","2.11.2","2.12.0","2.12.1","2.4","2.4.1","2.5","2.6","2.6.1","2.6.2","2.7","2.8","2.8.1","2.8.2","2.9.0","2.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.8.0"},{"fixed":"1.9.2"}]}],"package":{"name":"org.ops4j.pax.logging:pax-logging-log4j2","purl":"pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2","ecosystem":"Maven"},"versions":["1.8.0","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.8.6","1.8.7","1.9.0","1.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.10.8"}]}],"package":{"name":"org.ops4j.pax.logging:pax-logging-log4j2","purl":"pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2","ecosystem":"Maven"},"versions":["1.10.0","1.10.1","1.10.2","1.10.3","1.10.4","1.10.5","1.10.6","1.10.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.11.0"},{"fixed":"1.11.11"}]}],"package":{"name":"org.ops4j.pax.logging:pax-logging-log4j2","purl":"pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2","ecosystem":"Maven"},"versions":["1.11.0","1.11.1","1.11.10","1.11.2","1.11.3","1.11.4","1.11.5","1.11.6","1.11.7","1.11.8","1.11.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.12"}]}],"package":{"name":"org.ops4j.pax.logging:pax-logging-log4j2","purl":"pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2","ecosystem":"Maven"},"versions":["2.0.0","2.0.1","2.0.10","2.0.11","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.0.8","2.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1"}]}],"package":{"name":"org.apache.logging.log4j:log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core","ecosystem":"Maven"},"versions":["2.0","2.0-alpha1","2.0-alpha2","2.0-beta1","2.0-beta2","2.0-beta3","2.0-beta4","2.0-beta5","2.0-beta6","2.0-beta7","2.0-beta8","2.0-beta9","2.0-rc1","2.0-rc2","2.0.1","2.0.2","2.1","2.2","2.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rjr-3q55-vv33/GHSA-7rjr-3q55-vv33.json"}}],"modified":"2026-10-02T20:30:05.438504645Z","provider":"osv","references":["https://nvd.nist.gov/vuln/detail/CVE-2021-45046","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/alert-cve-2021-44228.html","https://www.openwall.com/lists/oss-security/2021/12/18/1","https://www.openwall.com/lists/oss-security/2021/12/15/3","https://www.openwall.com/lists/oss-security/2021/12/14/4","https://www.kb.cert.org/vuls/id/930724","https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html","https://www.debian.org/security/2021/dsa-5022","https://www.cve.org/CVERecord?id=CVE-2021-44228","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-45046","https://security.gentoo.org/glsa/202310-16","https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd","https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032","https://logging.apache.org/security.html#CVE-2021-45046","https://logging.apache.org/log4j/2.x/security.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SIG7FZULMNK2XF6FZRU4VWYDQXNMUGAJ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EOKPQGV24RRBBI4TBZUDQMM4MEH7MXCY","https://github.com/apache/logging-log4j2/compare/rel/2.3...rel/2.3.1","https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf","https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf"],"provider_metadata":{"cwe_ids":["CWE-502","CWE-917"],"severity":"CRITICAL","github_reviewed":true,"nvd_published_at":"2021-12-14T19:15:00Z","github_reviewed_at":"2021-12-14T17:55:00Z"}},"related_cves":[{"value":"CVE-2021-45046","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":"/database_specific/severity"},"group_id":"osv:GHSA-7rjr-3q55-vv33","priority":{"reasons":["publisher_severity","known_exploited"],"severity":"critical","linked_cves":[{"cve":"CVE-2021-45046","metrics":[],"products":[{"name":{"value":"Log4j2","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-45046","relationship":"advisory","known_exploited":true,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":true,"publisher_severity":"critical"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-7rjr-3q55-vv33","advisory_id":"725df016-b7b0-4081-9f5a-91206a3c647e","event_types":["advisory"],"published_at":"2026-10-25T22:46:02.756476+00:00","technologies":["core-osv","org-apache-logging-log4j-log4j-core","org-ops4j-pax-logging-pax-logging-log4j2"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-12-14T18:01:28+00:00","detail_url":"/events/71350"}]}}],"next_after":70977,"next_before":70977}