6.3

CVE-2025-68161: Apache Log4j Core: Missing TLS hostname verification in Socket appender

Modified
AliasesSUSE-SU-2026:0254-1UBUNTU-CVE-2025-68161DEBIAN-CVE-2025-68161
Published 18-12-2025Last modified 10-04-2026

Vulnerability summary

CVE-2025-68161 is a medium (CVSS 6.3) vulnerability in apache software foundation apache log4j core. EPSS estimates a 0.77% chance of exploitation in the next 30 days, higher than 55.5% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Routine

Not severe (CVSS 6.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
6.3/10
010
Medium · v4.0 (CVE.org)
EPSS score
0.77%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 1 · Related 18
OPENSUSE-SU-2026:20099-1CGA-33X7-WG96-6HPCCGA-38XR-XX49-MCFMCGA-3MX6-9MCQ-3RG2CGA-4FC4-4FMV-FQ64CGA-4PHJ-QJGM-9WQX

Timeline

  1. 18-12-2025
    PublishedVulnerability first disclosed.
  2. 10-04-2026
    Last modifiedVulnerability information updated.

Description

The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true. This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions: * The attacker is able to intercept or redirect network traffic between the client and the log receiver. * The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured). Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue. As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.

CVSS metrics

9 scores · 7 sources · 2 versions

EPSS trend

Probability

0.77%

Chance of exploitation in the next 30 days

Percentile

56%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.77% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (logging.apache.org)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard183 products
  • airflow-3< 3.2.0-r0
  • airflow-3-bitnami-compatAll versions (No fix recorded)
  • akhq< 0.27.0-r1
  • apache-activemq-6.1< 6.1.8-r3
  • apache-activemq-artemis< 2.44.0-r2
Wolfi15 products
  • airflow-3< 3.2.0-r0
  • airflow-3-bitnami-compatAll versions (No fix recorded)
  • akhq< 0.27.0-r1
  • apache-activemq-artemis< 2.44.0-r2
  • apache-activemq-artemis-compat< 2.44.0-r2
Apache1 product
  • log4j≥ 2.0.1, < 2.25.3 | 2.0 | 2.0:beta9 | 2.0:rc1 | 2.0:rc1-rc1 | 2.0:rc2
Apache software foundation1 product

4 vendors · 200 products · Showing 200 of 242

References

19 links
Show all 19 references