7.5

CVE-2023-26464: Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender

Modified
AliasesUBUNTU-CVE-2023-26464CGA-q8fr-7649-jcx3CGA-vv7v-qwxm-2j6x
Published 10-03-2023Last modified 13-02-2025

Vulnerability summary

CVE-2023-26464 is a high (CVSS 7.5) Deserialization of Untrusted Data vulnerability in apache software foundation apache log4j. EPSS estimates a 1.91% chance of exploitation in the next 30 days, higher than 79.7% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 7.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 2% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
1.91%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6 · Related 1
RHSA-2023:3663RHSA-2023:5484RHSA-2023:5485RHSA-2023:5486RHSA-2024:10207RHSA-2024:10208

Timeline

  1. 10-03-2023
    PublishedVulnerability first disclosed.
  2. 13-02-2025
    Last modifiedVulnerability information updated.

Description

** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested) hashmap or hashtable (depending on which logging component is in use) to be processed could exhaust the available memory in the virtual machine and achieve Denial of Service when the object is deserialized. This issue affects Apache Log4j before 2. Affected users are recommended to update to Log4j 2.x. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CVSS metrics

6 scores · 6 sources · 1 version

EPSS trend

Probability

1.91%

Chance of exploitation in the next 30 days

Percentile

80%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.91% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard4 products
  • druidAll versions (No fix recorded)
  • hadoop-fips-3.3.6All versions (No fix recorded)
  • hadoop-fips-3.4.2All versions (No fix recorded)
  • hadoop-fips-3.5All versions (No fix recorded)
Apache1 product
Apache software foundation1 product
Log4j1 product
  • log4j≥ 1.0.4, < 2.0
Org.apache.logging.log4j1 product
  • log4j-core≥ 1.0.4, < 2.0
Ubuntu1 product
  • apache-log4j1.2All versions (No fix recorded)
Wolfi1 product
  • druidAll versions (No fix recorded)

7 vendors · 10 products

References

8 links