9.8

CVE-2019-17571: apache software foundation log4j Deserialization of Untrusted Data

Modified
AliasesSUSE-SU-2020:0053-1SUSE-SU-2020:0054-1SUSE-SU-2020:14267-1
Published 20-12-2019Last modified 28-05-2026

Vulnerability summary

CVE-2019-17571 is a critical (CVSS 9.8) Deserialization of Untrusted Data vulnerability in apache software foundation log4j. EPSS estimates a 69.98% chance of exploitation in the next 30 days, higher than 99.3% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 9.8 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 70% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
69.98%
0%100%
Critical · +0.92 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7 · Related 2
MGASA-2023-0141RHSA-2017:1801RHSA-2017:2423RHSA-2017:2638RHSA-2017:2811RHSA-2017:3399

Timeline

  1. 20-12-2019
    PublishedVulnerability first disclosed.
  2. 28-05-2026
    Last modifiedVulnerability information updated.

Description

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

CVSS metrics

9 scores · 8 sources · 2 versions

EPSS trend

Probability

69.98%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

Increase +0.92 pp

From 69.06% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse25 products
  • log4j&distro=HPE Helion OpenStack 8< 1.2.15-126.3.1
  • log4j&distro=SUSE Enterprise Storage 5< 1.2.15-126.3.1
  • log4j&distro=SUSE Linux Enterprise Module for Basesystem 15< 1.2.17-5.3.1
  • log4j&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 1.2.17-5.3.1
  • log4j&distro=SUSE Linux Enterprise Module for Development Tools 15< 1.2.17-5.3.1
Oracle10 products
Chainguard4 products
  • druidAll versions (No fix recorded) | < 35.0.1-r1
  • hadoop-fips-3.3.6All versions (No fix recorded)
  • hadoop-fips-3.4.2All versions (No fix recorded)
  • hadoop-fips-3.5All versions (No fix recorded)
Redhat4 products
  • log4j< 0:1.2.14-6.7.el6_10
  • log4j-debuginfo< 0:1.2.14-6.7.el6_10
  • log4j-javadoc< 0:1.2.14-6.7.el6_10
  • log4j-manual< 0:1.2.14-6.7.el6_10
Opensuse3 products
  • leapEOL15.1
  • log4j-mini&distro=openSUSE Leap 15.1< 1.2.17-lp151.5.3.1
  • log4j&distro=openSUSE Leap 15.1< 1.2.17-lp151.5.3.1
Apache2 products
Debian2 products
  • apache-log4j1.2< 1.2.17-9 | < 1.2.17-7+deb9u1 | < 1.2.17-8+deb10u1 | < 1.2.17-5+deb8u1
  • debian_linuxEOL8.0 | 9.0 | 10.0
Netapp2 products
Apache software foundation1 product
  • log4jversions up to 1.2.17
Canonical1 product
Log4j1 product
  • log4j≥ 1.2, ≤ 1.2.17
Org.zenframework.z8.dependencies.commons1 product
  • log4j-1.2.172.0
Ubuntu1 product
  • apache-log4j1.2All versions (No fix recorded) | < 1.2.17-7ubuntu1+esm1 | < 1.2.17-8+deb10u1build0.18.04.1
Wolfi1 product
  • druidAll versions (No fix recorded) | < 35.0.1-r1

14 vendors · 58 products

References

234 links
Show all 100 references

Showing 100 of 234.