Patchfirst
Patchfirst
CVE-2021-45105 Public exploit Medium · 5.9 EPSS >99.9%

Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

Apache Software Foundation · Apache Log4j2

Summary

Apache Log4j2, in the Apache Software Foundation's logging library, does not protect against uncontrolled recursion caused by self-referential lookups in versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1). An attacker who can control Thread Context Map data can send a crafted string that, when interpreted, causes a denial of service.

Official description · CVE.org

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

Breakdown
81.0 / 100
Exploited
Yes, in VulnCheck KEV
Reports
1
Tactics
2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

First seen exploited 4 days after disclosure. Public exploit code (PoC-in-GitHub) was available the same day.

  1. DisclosedPublic exploit codePoC-in-GitHubday 0
  2. First seen exploitedVulnCheck KEV evidence+4 days

7 fixes in log4j-core over 6 years. The latest fix listed for log4j-core is 2.25.4.

Fixes in log4j-coreMaven package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 2.13.2CVE-2020-948827 Apr 2020
  2. 2.15.0CVE-2021-4422810 Dec 2021KEV
  3. 2.16.0CVE-2021-4504614 Dec 2021KEV
  4. 2.17.0CVE-2021-4510518 Dec 2021
  5. 2.17.1CVE-2021-4483228 Dec 2021
  6. 2.25.3CVE-2025-6816118 Dec 2025
  7. 2.25.4CVE-2026-3447710 Apr 2026Latest listed

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Exploit Public-Facing Application T1190 Medium
AI mapping from the description · how it is exploited

remote attacker exploits public-facing logging library input

did not protect from uncontrolled recursion from self-referential lookups
From the official description (CVE.org) Original (opens in a new tab) ↗

ImpactTA0040

Application or System Exploitation T1499.004 Medium
AI mapping from the description · primary impact

crafted string causes application denial of service

cause a denial of service when a crafted string is interpreted
From the official description (CVE.org) Original (opens in a new tab) ↗

Detection

0 rules for this CVE · 152 general rules for its techniques

Rules for this CVE

0 that reference CVE-2021-45105 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Exploit Public-Facing ApplicationT1190149 general rules
All 149 on SigmaHQ ↗
Application or System ExploitationT1499.0043 general rules

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

2 packages in 1 ecosystem. Main package: org.apache.logging.log4j:log4j-core.

Mavenorg.apache.logging.log4j:log4j-coreGHSA-p6xc-xr62-6r2g

Upgrade to 2.17.1 or later

Fixes this CVE and 3 other known vulnerabilities in this package (CVE-2021-44228, CVE-2021-44832, +1).

Set the version to 2.17.1 or later in your pom.xml or build.gradle.

First fixed in 2.17.0 for CVE-2021-45105.

Affected versions, by release line

If you runUpgrade to
2.13.0 up to 2.17.02.17.1first fix for this CVE: 2.17.0
2.4.0 up to 2.12.32.12.4first fix for this CVE: 2.12.3
All versions before 2.3.1

Still affected on this line by CVE-2017-5645 (fixed in 2.8.2, a newer line).

2.3.2first fix for this CVE: 2.3.1

“Up to” means the second version is the fix and is not affected.

Other packages that bundle this code (1)

Forks, repackagings and products that include the affected code. Each has its own fixed version.

  • Mavenorg.ops4j.pax.logging:pax-logging-log4j2
    Affected: 2.0.0 up to 2.0.13; 1.11.0 up to 1.11.12; 1.10.0 up to 1.10.9; 1.8.0 up to 1.9.2Upgrade to 2.0.14 or later (older lines: 1.11.13, 1.10.9, 1.9.2)
    GHSA-p6xc-xr62-6r2g

Check your lockfile against all CVEs

What security researchers reported

Named in 1 threat report
1 reportLinkedIn

Reports are matched by finding the exact id CVE-2021-45105 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

LinkedInUndated

RaaS AvosLocker Incident Response Analysis

…vulnerabilities associated to Log4J were found on the VMWare Horizon Unified Access Gateways, UAG01 and UAG02, those were CVE-2021-44228 / CVE-2021-45046 / CVE-2021-45105 / CVE-2021-44832, which can potentially allow remote code execution on Unified Access Gateway by the low privilege non-root user named…

Original (opens in a new tab) ↗

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

13 links, grouped by NVD tag

x_refsource_MISC 5

logging.apache.org/log4j/2.x/security.htmlzerodayinitiative.com/advisories/ZDI-21-1541/oracle.com/security-alerts/cpujan2022.htmloracle.com/security-alerts/cpuapr2022.htmloracle.com/security-alerts/cpujul2022.html

x_refsource_CONFIRM 4

psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032cert-portal.siemens.com/productcert/pdf/ssa-479842.pdfsecurity.netapp.com/advisory/ntap-20211218-0001/cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf

third-party-advisory 1

kb.cert.org/vuls/id/930724

vendor-advisory 2

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbddebian.org/security/2021/dsa-5024

mailing-list 1

openwall.com/lists/oss-security/2021/12/19/1
↑ ↓ chooseEnter openEsc close