apache-log4j2 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the apache-log4j2 package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free
VulnerabilityVulnerable Version
  • M
Improper Input Validation

<2.17.1-1~deb10u1
  • M
Improper Input Validation

<2.17.0-1~deb10u1
  • C
Expression Language Injection

<2.16.0-1~deb10u1
  • C
Improper Input Validation

<2.15.0-1~deb10u1
  • L
Improper Certificate Validation

<2.15.0-1~deb10u1
  • C
Deserialization of Untrusted Data

<2.7-2