Critical

Apache Log4j2 Deserialization of Untrusted Data Vulnerability

Type: advisorySource: CISA Known Exploited VulnerabilitiesRisk context updatedKnown exploited1 source record

Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations. CISA required action: Apply updates per vendor instructions.

Announced 1 May 2023Source revision 2

Original source ↗

CVE context updated. The publisher announcement is unchanged.

CVE-2021-45046

Primary source · Revision 2

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2021-45046

Log4j2

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2021-45046
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Linked CVE context

These ratings describe the referenced vulnerabilities and products. They are not a severity rating for every application using this dependency.

CVE-2021-45046 · Critical

org.apache.logging.log4j:log4j-core, org.apache.logging.log4j:log4j-core, org.ops4j.pax.logging:pax-logging-log4j2, org.ops4j.pax.logging:pax-logging-log4j2, org.ops4j.pax.logging:pax-logging-log4j2, org.ops4j.pax.logging:pax-logging-log4j2, org.apache.logging.log4j:log4j-core

Event: #71351 · Revision 2
Added to Heist Feed: Sun, 25 Oct 2026 22:46:02 GMT
Publisher date: Mon, 01 May 2023 00:00:00 GMT

Read the original announcement