CVE-2021-44832: apache software foundation apache log4j2 Improper Input Validation
CVSS: 8.5v2.0HighModified
AliasesMGASA-2022-0002UBUNTU-CVE-2021-44832DEBIAN-CVE-2021-44832DLA-2870-1openSUSE-SU-2021:4208-1openSUSE-SU-2022:0002-1GHSA-8489-44mv-ggj8
Published 28-12-2021Last modified 29-05-2026
Vulnerability summary
CVE-2021-44832 is a high (CVSS 8.5) Improper Input Validation vulnerability in apache software foundation apache log4j2. EPSS estimates a 97.91% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities.
CVSS score
8.5/10
010
High · v2.0 (NVD)EPSS score
97.91%
0%100%
Critical · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 1Timeline
- 28-12-2021PublishedVulnerability first disclosed.
- 29-05-2026Last modifiedVulnerability information updated.
Description
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
CVSS metrics
6 scores · 5 sources · 2 versionsMedium 6.6Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated6.6MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated6.6MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- OSV · MavenEcosystem advisory · calculated6.6MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- NVDNIST6.6MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
High 8.5Preferred score · NVD (NIST)
AV:N/AC:M/Au:S/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
97.91%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 97.91% on 18-09-2026
18-09-202618-10-2026
EPSS score97.91%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Affected systems
Oracle18 products
- communications_brm_-_elastic_charging_engine< 12.0.0.4.6 | 12.0.0.5.0
- communications_diameter_signaling_router≥ 8.0.0.0, ≤ 8.5.1.0 | ≥ 8.3.0.0, ≤ 8.5.1.0
- communications_interactive_session_recorder6.3 | 6.4
- communications_offline_mediation_controller< 12.0.0.4.4 | 12.0.0.5.0
- flexcube_private_banking12.1.0
Debian2 products
- apache-log4j2< 2.17.1-1 | < 2.12.4-0+deb9u1
- debian_linuxEOL9.0
Opensuse2 products
- log4j&distro=openSUSE Leap 15.2< 2.17.0-lp152.3.15.1
- log4j&distro=openSUSE Leap 15.3< 2.17.0-4.16.1
Apache1 product
- log4j≥ 2.0.1, < 2.3.2 | ≥ 2.4, < 2.12.4 | ≥ 2.13.0, < 2.17.1 | 2.0 | 2.0:beta7 | 2.0:beta8 | 2.0:beta9 | 2.0:rc1 | 2.0:rc2
Apache software foundation1 product
- apache log4j2≥ log4j-core, < 2.17.1
Cisco1 product
- cloudcenter4.10.0.16
Fedoraproject1 product
- fedoraEOL34 | 35
Mageia1 product
- log4j< 2.17.1-1.mga8
Org.apache.logging.log4j1 product
- log4j-core≥ 2.0-beta7, < 2.3.2 | ≥ 2.4, < 2.12.4 | ≥ 2.13.0, < 2.17.1
Org.ops4j.pax.logging1 product
- pax-logging-log4j2≥ 1.8.0, < 1.9.2 | ≥ 1.10.0, < 1.10.9 | ≥ 1.11.0, < 1.11.13 | ≥ 2.0.0, < 2.0.14
Ubuntu1 product
- apache-log4j2All versions (No fix recorded) | < 2.12.4-0ubuntu0.1 | < 2.17.1-0.20.04.1
11 vendors · 30 products
References
32 links- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbdVendor AdvisoryX Refsource CISCOWEBThird Party Advisory
- lists.apache.org/thread/s1o5vlo78ypqxnzn6p8zf6t9shtq5143X Refsource MISCWEBMailing ListVendor Advisory
- issues.apache.org/jira/browse/LOG4J2-3293X Refsource MISCREPORTWEBIssue TrackingPatchVendor Advisory
- www.openwall.com/lists/oss-security/2021/12/28/1Mailing ListX Refsource MLISTWEBThird Party Advisory
lists.debian.org/debian-lts-announce/2021/12/msg00036.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
Show all 32 references
- lists.opensuse.org/archives/…Advisory
