{"schema_version":"2","view":"grouped","data":[{"id":70978,"cve_ids":["CVE-2021-45046"],"payload":{"kind":"advisory","title":"Apache Log4j2 Deserialization of Untrusted Data Vulnerability","summary":"Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-45046","products":[{"name":{"value":"Log4j2","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-45046","aliases":["CVE-2021-45046"],"affected":[],"modified":"2023-05-01T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-917"],"cveID":"CVE-2021-45046","notes":"https://logging.apache.org/log4j/2.x/security.html; https://nvd.nist.gov/vuln/detail/CVE-2021-45046","dueDate":"2023-05-22","product":"Log4j2","dateAdded":"2023-05-01","vendorProject":"Apache","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.","vulnerabilityName":"Apache Log4j2 Deserialization of Untrusted Data Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-45046","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b33b2fa9-dc28-4556-a9ab-5aeae95fd000","priority":{"reasons":["linked_severity","known_exploited"],"severity":"critical","linked_cves":[{"cve":"CVE-2021-45046","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}],"products":[{"name":{"value":"org.apache.logging.log4j:log4j-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.16.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.13.0","evidence":"/affected/0/versions"},{"value":"2.13.1","evidence":"/affected/0/versions"},{"value":"2.13.2","evidence":"/affected/0/versions"},{"value":"2.13.3","evidence":"/affected/0/versions"},{"value":"2.14.0","evidence":"/affected/0/versions"},{"value":"2.14.1","evidence":"/affected/0/versions"},{"value":"2.15.0","evidence":"/affected/0/versions"}]},{"name":{"value":"org.apache.logging.log4j:log4j-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.12.2","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.10.0","evidence":"/affected/1/versions"},{"value":"2.11.0","evidence":"/affected/1/versions"},{"value":"2.11.1","evidence":"/affected/1/versions"},{"value":"2.11.2","evidence":"/affected/1/versions"},{"value":"2.12.0","evidence":"/affected/1/versions"},{"value":"2.12.1","evidence":"/affected/1/versions"},{"value":"2.4","evidence":"/affected/1/versions"},{"value":"2.4.1","evidence":"/affected/1/versions"},{"value":"2.5","evidence":"/affected/1/versions"},{"value":"2.6","evidence":"/affected/1/versions"},{"value":"2.6.1","evidence":"/affected/1/versions"},{"value":"2.6.2","evidence":"/affected/1/versions"},{"value":"2.7","evidence":"/affected/1/versions"},{"value":"2.8","evidence":"/affected/1/versions"},{"value":"2.8.1","evidence":"/affected/1/versions"},{"value":"2.8.2","evidence":"/affected/1/versions"},{"value":"2.9.0","evidence":"/affected/1/versions"},{"value":"2.9.1","evidence":"/affected/1/versions"}]},{"name":{"value":"org.ops4j.pax.logging:pax-logging-log4j2","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.9.2","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"1.8.0","evidence":"/affected/2/versions"},{"value":"1.8.1","evidence":"/affected/2/versions"},{"value":"1.8.2","evidence":"/affected/2/versions"},{"value":"1.8.3","evidence":"/affected/2/versions"},{"value":"1.8.4","evidence":"/affected/2/versions"},{"value":"1.8.5","evidence":"/affected/2/versions"},{"value":"1.8.6","evidence":"/affected/2/versions"},{"value":"1.8.7","evidence":"/affected/2/versions"},{"value":"1.9.0","evidence":"/affected/2/versions"},{"value":"1.9.1","evidence":"/affected/2/versions"}]},{"name":{"value":"org.ops4j.pax.logging:pax-logging-log4j2","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.10.8","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"1.10.0","evidence":"/affected/3/versions"},{"value":"1.10.1","evidence":"/affected/3/versions"},{"value":"1.10.2","evidence":"/affected/3/versions"},{"value":"1.10.3","evidence":"/affected/3/versions"},{"value":"1.10.4","evidence":"/affected/3/versions"},{"value":"1.10.5","evidence":"/affected/3/versions"},{"value":"1.10.6","evidence":"/affected/3/versions"},{"value":"1.10.7","evidence":"/affected/3/versions"}]},{"name":{"value":"org.ops4j.pax.logging:pax-logging-log4j2","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.11.11","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"1.11.0","evidence":"/affected/4/versions"},{"value":"1.11.1","evidence":"/affected/4/versions"},{"value":"1.11.10","evidence":"/affected/4/versions"},{"value":"1.11.2","evidence":"/affected/4/versions"},{"value":"1.11.3","evidence":"/affected/4/versions"},{"value":"1.11.4","evidence":"/affected/4/versions"},{"value":"1.11.5","evidence":"/affected/4/versions"},{"value":"1.11.6","evidence":"/affected/4/versions"},{"value":"1.11.7","evidence":"/affected/4/versions"},{"value":"1.11.8","evidence":"/affected/4/versions"},{"value":"1.11.9","evidence":"/affected/4/versions"}]},{"name":{"value":"org.ops4j.pax.logging:pax-logging-log4j2","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.0.12","evidence":"/affected/5/ranges"}],"affected_versions":[{"value":"2.0.0","evidence":"/affected/5/versions"},{"value":"2.0.1","evidence":"/affected/5/versions"},{"value":"2.0.10","evidence":"/affected/5/versions"},{"value":"2.0.11","evidence":"/affected/5/versions"},{"value":"2.0.2","evidence":"/affected/5/versions"},{"value":"2.0.3","evidence":"/affected/5/versions"},{"value":"2.0.4","evidence":"/affected/5/versions"},{"value":"2.0.5","evidence":"/affected/5/versions"},{"value":"2.0.6","evidence":"/affected/5/versions"},{"value":"2.0.7","evidence":"/affected/5/versions"},{"value":"2.0.8","evidence":"/affected/5/versions"},{"value":"2.0.9","evidence":"/affected/5/versions"}]},{"name":{"value":"org.apache.logging.log4j:log4j-core","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.3.1","evidence":"/affected/6/ranges"}],"affected_versions":[{"value":"2.0","evidence":"/affected/6/versions"},{"value":"2.0-alpha1","evidence":"/affected/6/versions"},{"value":"2.0-alpha2","evidence":"/affected/6/versions"},{"value":"2.0-beta1","evidence":"/affected/6/versions"},{"value":"2.0-beta2","evidence":"/affected/6/versions"},{"value":"2.0-beta3","evidence":"/affected/6/versions"},{"value":"2.0-beta4","evidence":"/affected/6/versions"},{"value":"2.0-beta5","evidence":"/affected/6/versions"},{"value":"2.0-beta6","evidence":"/affected/6/versions"},{"value":"2.0-beta7","evidence":"/affected/6/versions"},{"value":"2.0-beta8","evidence":"/affected/6/versions"},{"value":"2.0-beta9","evidence":"/affected/6/versions"},{"value":"2.0-rc1","evidence":"/affected/6/versions"},{"value":"2.0-rc2","evidence":"/affected/6/versions"},{"value":"2.0.1","evidence":"/affected/6/versions"},{"value":"2.0.2","evidence":"/affected/6/versions"},{"value":"2.1","evidence":"/affected/6/versions"},{"value":"2.2","evidence":"/affected/6/versions"},{"value":"2.3","evidence":"/affected/6/versions"}]}],"severity":"critical","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-7rjr-3q55-vv33","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":2,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-45046","advisory_id":"b33b2fa9-dc28-4556-a9ab-5aeae95fd000","event_types":["advisory"],"published_at":"2026-10-25T22:46:02.756476+00:00","technologies":["core-kev","log4j2"],"context_update":true,"extraction_method":"structured","source_published_at":"2023-05-01T00:00:00+00:00","detail_url":"/advisories/advisory%3Ab33b2fa9-dc28-4556-a9ab-5aeae95fd000","group":{"id":"advisory:b33b2fa9-dc28-4556-a9ab-5aeae95fd000","revision":2,"primary_event_id":71351,"change":"context","superseded_by":[],"changed":{"id":71351,"cve_ids":["CVE-2021-45046"],"payload":{"kind":"advisory","title":"Apache Log4j2 Deserialization of Untrusted Data Vulnerability","summary":"Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-45046","products":[{"name":{"value":"Log4j2","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-45046","aliases":["CVE-2021-45046"],"affected":[],"modified":"2023-05-01T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-917"],"cveID":"CVE-2021-45046","notes":"https://logging.apache.org/log4j/2.x/security.html; https://nvd.nist.gov/vuln/detail/CVE-2021-45046","dueDate":"2023-05-22","product":"Log4j2","dateAdded":"2023-05-01","vendorProject":"Apache","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.","vulnerabilityName":"Apache Log4j2 Deserialization of Untrusted Data Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-45046","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b33b2fa9-dc28-4556-a9ab-5aeae95fd000","priority":{"reasons":["linked_severity","known_exploited"],"severity":"critical","linked_cves":[{"cve":"CVE-2021-45046","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}],"products":[{"name":{"value":"org.apache.logging.log4j:log4j-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.16.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.13.0","evidence":"/affected/0/versions"},{"value":"2.13.1","evidence":"/affected/0/versions"},{"value":"2.13.2","evidence":"/affected/0/versions"},{"value":"2.13.3","evidence":"/affected/0/versions"},{"value":"2.14.0","evidence":"/affected/0/versions"},{"value":"2.14.1","evidence":"/affected/0/versions"},{"value":"2.15.0","evidence":"/affected/0/versions"}]},{"name":{"value":"org.apache.logging.log4j:log4j-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.12.2","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.10.0","evidence":"/affected/1/versions"},{"value":"2.11.0","evidence":"/affected/1/versions"},{"value":"2.11.1","evidence":"/affected/1/versions"},{"value":"2.11.2","evidence":"/affected/1/versions"},{"value":"2.12.0","evidence":"/affected/1/versions"},{"value":"2.12.1","evidence":"/affected/1/versions"},{"value":"2.4","evidence":"/affected/1/versions"},{"value":"2.4.1","evidence":"/affected/1/versions"},{"value":"2.5","evidence":"/affected/1/versions"},{"value":"2.6","evidence":"/affected/1/versions"},{"value":"2.6.1","evidence":"/affected/1/versions"},{"value":"2.6.2","evidence":"/affected/1/versions"},{"value":"2.7","evidence":"/affected/1/versions"},{"value":"2.8","evidence":"/affected/1/versions"},{"value":"2.8.1","evidence":"/affected/1/versions"},{"value":"2.8.2","evidence":"/affected/1/versions"},{"value":"2.9.0","evidence":"/affected/1/versions"},{"value":"2.9.1","evidence":"/affected/1/versions"}]},{"name":{"value":"org.ops4j.pax.logging:pax-logging-log4j2","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.9.2","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"1.8.0","evidence":"/affected/2/versions"},{"value":"1.8.1","evidence":"/affected/2/versions"},{"value":"1.8.2","evidence":"/affected/2/versions"},{"value":"1.8.3","evidence":"/affected/2/versions"},{"value":"1.8.4","evidence":"/affected/2/versions"},{"value":"1.8.5","evidence":"/affected/2/versions"},{"value":"1.8.6","evidence":"/affected/2/versions"},{"value":"1.8.7","evidence":"/affected/2/versions"},{"value":"1.9.0","evidence":"/affected/2/versions"},{"value":"1.9.1","evidence":"/affected/2/versions"}]},{"name":{"value":"org.ops4j.pax.logging:pax-logging-log4j2","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.10.8","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"1.10.0","evidence":"/affected/3/versions"},{"value":"1.10.1","evidence":"/affected/3/versions"},{"value":"1.10.2","evidence":"/affected/3/versions"},{"value":"1.10.3","evidence":"/affected/3/versions"},{"value":"1.10.4","evidence":"/affected/3/versions"},{"value":"1.10.5","evidence":"/affected/3/versions"},{"value":"1.10.6","evidence":"/affected/3/versions"},{"value":"1.10.7","evidence":"/affected/3/versions"}]},{"name":{"value":"org.ops4j.pax.logging:pax-logging-log4j2","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.11.11","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"1.11.0","evidence":"/affected/4/versions"},{"value":"1.11.1","evidence":"/affected/4/versions"},{"value":"1.11.10","evidence":"/affected/4/versions"},{"value":"1.11.2","evidence":"/affected/4/versions"},{"value":"1.11.3","evidence":"/affected/4/versions"},{"value":"1.11.4","evidence":"/affected/4/versions"},{"value":"1.11.5","evidence":"/affected/4/versions"},{"value":"1.11.6","evidence":"/affected/4/versions"},{"value":"1.11.7","evidence":"/affected/4/versions"},{"value":"1.11.8","evidence":"/affected/4/versions"},{"value":"1.11.9","evidence":"/affected/4/versions"}]},{"name":{"value":"org.ops4j.pax.logging:pax-logging-log4j2","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.0.12","evidence":"/affected/5/ranges"}],"affected_versions":[{"value":"2.0.0","evidence":"/affected/5/versions"},{"value":"2.0.1","evidence":"/affected/5/versions"},{"value":"2.0.10","evidence":"/affected/5/versions"},{"value":"2.0.11","evidence":"/affected/5/versions"},{"value":"2.0.2","evidence":"/affected/5/versions"},{"value":"2.0.3","evidence":"/affected/5/versions"},{"value":"2.0.4","evidence":"/affected/5/versions"},{"value":"2.0.5","evidence":"/affected/5/versions"},{"value":"2.0.6","evidence":"/affected/5/versions"},{"value":"2.0.7","evidence":"/affected/5/versions"},{"value":"2.0.8","evidence":"/affected/5/versions"},{"value":"2.0.9","evidence":"/affected/5/versions"}]},{"name":{"value":"org.apache.logging.log4j:log4j-core","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.3.1","evidence":"/affected/6/ranges"}],"affected_versions":[{"value":"2.0","evidence":"/affected/6/versions"},{"value":"2.0-alpha1","evidence":"/affected/6/versions"},{"value":"2.0-alpha2","evidence":"/affected/6/versions"},{"value":"2.0-beta1","evidence":"/affected/6/versions"},{"value":"2.0-beta2","evidence":"/affected/6/versions"},{"value":"2.0-beta3","evidence":"/affected/6/versions"},{"value":"2.0-beta4","evidence":"/affected/6/versions"},{"value":"2.0-beta5","evidence":"/affected/6/versions"},{"value":"2.0-beta6","evidence":"/affected/6/versions"},{"value":"2.0-beta7","evidence":"/affected/6/versions"},{"value":"2.0-beta8","evidence":"/affected/6/versions"},{"value":"2.0-beta9","evidence":"/affected/6/versions"},{"value":"2.0-rc1","evidence":"/affected/6/versions"},{"value":"2.0-rc2","evidence":"/affected/6/versions"},{"value":"2.0.1","evidence":"/affected/6/versions"},{"value":"2.0.2","evidence":"/affected/6/versions"},{"value":"2.1","evidence":"/affected/6/versions"},{"value":"2.2","evidence":"/affected/6/versions"},{"value":"2.3","evidence":"/affected/6/versions"}]}],"severity":"critical","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-7rjr-3q55-vv33","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":2,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-45046","advisory_id":"b33b2fa9-dc28-4556-a9ab-5aeae95fd000","event_types":["advisory"],"published_at":"2026-10-25T22:46:02.756476+00:00","technologies":["core-kev","log4j2"],"context_update":true,"extraction_method":"structured","source_published_at":"2023-05-01T00:00:00+00:00","detail_url":"/events/71351"},"members":[{"id":71351,"cve_ids":["CVE-2021-45046"],"payload":{"kind":"advisory","title":"Apache Log4j2 Deserialization of Untrusted Data Vulnerability","summary":"Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2021-45046","products":[{"name":{"value":"Log4j2","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-45046","aliases":["CVE-2021-45046"],"affected":[],"modified":"2023-05-01T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-917"],"cveID":"CVE-2021-45046","notes":"https://logging.apache.org/log4j/2.x/security.html; https://nvd.nist.gov/vuln/detail/CVE-2021-45046","dueDate":"2023-05-22","product":"Log4j2","dateAdded":"2023-05-01","vendorProject":"Apache","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.","vulnerabilityName":"Apache Log4j2 Deserialization of Untrusted Data Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-45046","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:b33b2fa9-dc28-4556-a9ab-5aeae95fd000","priority":{"reasons":["linked_severity","known_exploited"],"severity":"critical","linked_cves":[{"cve":"CVE-2021-45046","metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H"}],"products":[{"name":{"value":"org.apache.logging.log4j:log4j-core","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.16.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"2.13.0","evidence":"/affected/0/versions"},{"value":"2.13.1","evidence":"/affected/0/versions"},{"value":"2.13.2","evidence":"/affected/0/versions"},{"value":"2.13.3","evidence":"/affected/0/versions"},{"value":"2.14.0","evidence":"/affected/0/versions"},{"value":"2.14.1","evidence":"/affected/0/versions"},{"value":"2.15.0","evidence":"/affected/0/versions"}]},{"name":{"value":"org.apache.logging.log4j:log4j-core","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.12.2","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"2.10.0","evidence":"/affected/1/versions"},{"value":"2.11.0","evidence":"/affected/1/versions"},{"value":"2.11.1","evidence":"/affected/1/versions"},{"value":"2.11.2","evidence":"/affected/1/versions"},{"value":"2.12.0","evidence":"/affected/1/versions"},{"value":"2.12.1","evidence":"/affected/1/versions"},{"value":"2.4","evidence":"/affected/1/versions"},{"value":"2.4.1","evidence":"/affected/1/versions"},{"value":"2.5","evidence":"/affected/1/versions"},{"value":"2.6","evidence":"/affected/1/versions"},{"value":"2.6.1","evidence":"/affected/1/versions"},{"value":"2.6.2","evidence":"/affected/1/versions"},{"value":"2.7","evidence":"/affected/1/versions"},{"value":"2.8","evidence":"/affected/1/versions"},{"value":"2.8.1","evidence":"/affected/1/versions"},{"value":"2.8.2","evidence":"/affected/1/versions"},{"value":"2.9.0","evidence":"/affected/1/versions"},{"value":"2.9.1","evidence":"/affected/1/versions"}]},{"name":{"value":"org.ops4j.pax.logging:pax-logging-log4j2","evidence":"/affected/2/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.9.2","evidence":"/affected/2/ranges"}],"affected_versions":[{"value":"1.8.0","evidence":"/affected/2/versions"},{"value":"1.8.1","evidence":"/affected/2/versions"},{"value":"1.8.2","evidence":"/affected/2/versions"},{"value":"1.8.3","evidence":"/affected/2/versions"},{"value":"1.8.4","evidence":"/affected/2/versions"},{"value":"1.8.5","evidence":"/affected/2/versions"},{"value":"1.8.6","evidence":"/affected/2/versions"},{"value":"1.8.7","evidence":"/affected/2/versions"},{"value":"1.9.0","evidence":"/affected/2/versions"},{"value":"1.9.1","evidence":"/affected/2/versions"}]},{"name":{"value":"org.ops4j.pax.logging:pax-logging-log4j2","evidence":"/affected/3/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.10.8","evidence":"/affected/3/ranges"}],"affected_versions":[{"value":"1.10.0","evidence":"/affected/3/versions"},{"value":"1.10.1","evidence":"/affected/3/versions"},{"value":"1.10.2","evidence":"/affected/3/versions"},{"value":"1.10.3","evidence":"/affected/3/versions"},{"value":"1.10.4","evidence":"/affected/3/versions"},{"value":"1.10.5","evidence":"/affected/3/versions"},{"value":"1.10.6","evidence":"/affected/3/versions"},{"value":"1.10.7","evidence":"/affected/3/versions"}]},{"name":{"value":"org.ops4j.pax.logging:pax-logging-log4j2","evidence":"/affected/4/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.11.11","evidence":"/affected/4/ranges"}],"affected_versions":[{"value":"1.11.0","evidence":"/affected/4/versions"},{"value":"1.11.1","evidence":"/affected/4/versions"},{"value":"1.11.10","evidence":"/affected/4/versions"},{"value":"1.11.2","evidence":"/affected/4/versions"},{"value":"1.11.3","evidence":"/affected/4/versions"},{"value":"1.11.4","evidence":"/affected/4/versions"},{"value":"1.11.5","evidence":"/affected/4/versions"},{"value":"1.11.6","evidence":"/affected/4/versions"},{"value":"1.11.7","evidence":"/affected/4/versions"},{"value":"1.11.8","evidence":"/affected/4/versions"},{"value":"1.11.9","evidence":"/affected/4/versions"}]},{"name":{"value":"org.ops4j.pax.logging:pax-logging-log4j2","evidence":"/affected/5/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.0.12","evidence":"/affected/5/ranges"}],"affected_versions":[{"value":"2.0.0","evidence":"/affected/5/versions"},{"value":"2.0.1","evidence":"/affected/5/versions"},{"value":"2.0.10","evidence":"/affected/5/versions"},{"value":"2.0.11","evidence":"/affected/5/versions"},{"value":"2.0.2","evidence":"/affected/5/versions"},{"value":"2.0.3","evidence":"/affected/5/versions"},{"value":"2.0.4","evidence":"/affected/5/versions"},{"value":"2.0.5","evidence":"/affected/5/versions"},{"value":"2.0.6","evidence":"/affected/5/versions"},{"value":"2.0.7","evidence":"/affected/5/versions"},{"value":"2.0.8","evidence":"/affected/5/versions"},{"value":"2.0.9","evidence":"/affected/5/versions"}]},{"name":{"value":"org.apache.logging.log4j:log4j-core","evidence":"/affected/6/package/name"},"prerequisites":[],"fixed_versions":[{"value":"2.3.1","evidence":"/affected/6/ranges"}],"affected_versions":[{"value":"2.0","evidence":"/affected/6/versions"},{"value":"2.0-alpha1","evidence":"/affected/6/versions"},{"value":"2.0-alpha2","evidence":"/affected/6/versions"},{"value":"2.0-beta1","evidence":"/affected/6/versions"},{"value":"2.0-beta2","evidence":"/affected/6/versions"},{"value":"2.0-beta3","evidence":"/affected/6/versions"},{"value":"2.0-beta4","evidence":"/affected/6/versions"},{"value":"2.0-beta5","evidence":"/affected/6/versions"},{"value":"2.0-beta6","evidence":"/affected/6/versions"},{"value":"2.0-beta7","evidence":"/affected/6/versions"},{"value":"2.0-beta8","evidence":"/affected/6/versions"},{"value":"2.0-beta9","evidence":"/affected/6/versions"},{"value":"2.0-rc1","evidence":"/affected/6/versions"},{"value":"2.0-rc2","evidence":"/affected/6/versions"},{"value":"2.0.1","evidence":"/affected/6/versions"},{"value":"2.0.2","evidence":"/affected/6/versions"},{"value":"2.1","evidence":"/affected/6/versions"},{"value":"2.2","evidence":"/affected/6/versions"},{"value":"2.3","evidence":"/affected/6/versions"}]}],"severity":"critical","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-7rjr-3q55-vv33","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":2,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-45046","advisory_id":"b33b2fa9-dc28-4556-a9ab-5aeae95fd000","event_types":["advisory"],"published_at":"2026-10-25T22:46:02.756476+00:00","technologies":["core-kev","log4j2"],"context_update":true,"extraction_method":"structured","source_published_at":"2023-05-01T00:00:00+00:00","detail_url":"/events/71351"}]}},{"id":2954,"cve_ids":["CVE-2021-44228"],"payload":{"kind":"advisory","title":"Apache Log4j2 Remote Code Execution Vulnerability","summary":"Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution. CISA required action: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.","evidence":"kev:CVE-2021-44228","products":[{"name":{"value":"Log4j2","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-44228","aliases":["CVE-2021-44228"],"affected":[],"modified":"2021-12-10T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-20","CWE-400","CWE-502"],"cveID":"CVE-2021-44228","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228","dueDate":"2021-12-24","product":"Log4j2","dateAdded":"2021-12-10","vendorProject":"Apache","requiredAction":"For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.","known_exploited":true,"shortDescription":"Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.","vulnerabilityName":"Apache Log4j2 Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-44228","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:85af4e12-8f84-4c8c-b975-3497148f7df6","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44228","advisory_id":"85af4e12-8f84-4c8c-b975-3497148f7df6","event_types":["advisory"],"published_at":"2026-10-24T21:26:51.117734+00:00","technologies":["core-kev","log4j2"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-12-10T00:00:00+00:00","detail_url":"/advisories/advisory%3A85af4e12-8f84-4c8c-b975-3497148f7df6","group":{"id":"advisory:85af4e12-8f84-4c8c-b975-3497148f7df6","revision":1,"primary_event_id":2958,"change":"published","superseded_by":[],"changed":{"id":2958,"cve_ids":["CVE-2021-44228"],"payload":{"kind":"advisory","title":"Apache Log4j2 Remote Code Execution Vulnerability","summary":"Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution. CISA required action: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.","evidence":"kev:CVE-2021-44228","products":[{"name":{"value":"Log4j2","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-44228","aliases":["CVE-2021-44228"],"affected":[],"modified":"2021-12-10T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-20","CWE-400","CWE-502"],"cveID":"CVE-2021-44228","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228","dueDate":"2021-12-24","product":"Log4j2","dateAdded":"2021-12-10","vendorProject":"Apache","requiredAction":"For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.","known_exploited":true,"shortDescription":"Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.","vulnerabilityName":"Apache Log4j2 Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-44228","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:85af4e12-8f84-4c8c-b975-3497148f7df6","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44228","advisory_id":"85af4e12-8f84-4c8c-b975-3497148f7df6","event_types":["advisory"],"published_at":"2026-10-24T21:26:51.117734+00:00","technologies":["core-kev","log4j2"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-12-10T00:00:00+00:00","detail_url":"/events/2958"},"members":[{"id":2958,"cve_ids":["CVE-2021-44228"],"payload":{"kind":"advisory","title":"Apache Log4j2 Remote Code Execution Vulnerability","summary":"Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution. CISA required action: For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.","evidence":"kev:CVE-2021-44228","products":[{"name":{"value":"Log4j2","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2021-44228","aliases":["CVE-2021-44228"],"affected":[],"modified":"2021-12-10T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-20","CWE-400","CWE-502"],"cveID":"CVE-2021-44228","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-44228","dueDate":"2021-12-24","product":"Log4j2","dateAdded":"2021-12-10","vendorProject":"Apache","requiredAction":"For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.","known_exploited":true,"shortDescription":"Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.","vulnerabilityName":"Apache Log4j2 Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2021-44228","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:85af4e12-8f84-4c8c-b975-3497148f7df6","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44228","advisory_id":"85af4e12-8f84-4c8c-b975-3497148f7df6","event_types":["advisory"],"published_at":"2026-10-24T21:26:51.117734+00:00","technologies":["core-kev","log4j2"],"context_update":false,"extraction_method":"structured","source_published_at":"2021-12-10T00:00:00+00:00","detail_url":"/events/2958"}]}}],"next_after":70978,"next_before":2954}