5.9

CVE-2021-45105: Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

Modified
AliasesMGASA-2021-0572RHSA-2022:1462RHSA-2022:1463
Published 18-12-2021Last modified 29-05-2026

Vulnerability summary

CVE-2021-45105 is a medium (CVSS 5.9) Improper Input Validation vulnerability in apache software foundation apache log4j2. EPSS estimates a 100.00% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.9/10
010
Medium · v3.1 (CVE.org)
EPSS score
100.00%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 4 · Related 1
DLA-2852-1RHSA-2022:1296RHSA-2022:1297USN-5222-1

Timeline

  1. 18-12-2021
    PublishedVulnerability first disclosed.
  2. 29-05-2026
    Last modifiedVulnerability information updated.

Description

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

CVSS metrics

7 scores · 6 sources · 2 versions

EPSS trend

Probability

100.00%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 100.00% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Oracle105 products
Sonicwall8 products
Debian2 products
  • apache-log4j2< 2.17.0-1~deb10u1 | < 2.17.0-1~deb11u1 | < 2.17.0-1
  • debian_linuxEOL10.0 | 11.0
Opensuse2 products
  • log4j&distro=openSUSE Leap 15.2< 2.17.0-lp152.3.12.1
  • log4j&distro=openSUSE Leap 15.3< 2.17.0-4.13.1
Redhat2 products
  • rh-sso7-keycloak< 0:15.0.6-1.redhat_00001.1.el7sso | < 0:15.0.6-1.redhat_00001.1.el8sso
  • rh-sso7-keycloak-server< 0:15.0.6-1.redhat_00001.1.el7sso | < 0:15.0.6-1.redhat_00001.1.el8sso
Apache1 product
  • log4j≥ 2.0, < 2.3.1 | ≥ 2.4, < 2.12.3 | ≥ 2.13.0, ≤ 2.16.0
Apache software foundation1 product
Mageia1 product
  • log4j< 2.17.0-1.mga8
Netapp1 product
Org.apache.logging.log4j1 product
  • log4j-core≥ 2.4.0, < 2.12.3 | ≥ 2.13.0, < 2.17.0 | < 2.3.1
Org.ops4j.pax.logging1 product
  • pax-logging-log4j2≥ 1.8.0, < 1.9.2 | ≥ 1.10.0, < 1.10.9 | ≥ 1.11.0, < 1.11.12 | ≥ 2.0.0, < 2.0.13
Ubuntu1 product
  • apache-log4j2All versions (No fix recorded) | < 2.12.4-0ubuntu0.1 | < 2.17.0-0.20.04.1

12 vendors · 126 products

References

44 links
Show all 44 references