log4j | Snyk

Direct Vulnerabilities

Known vulnerabilities in the log4j package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
M Information Exposure	*
M Improper Certificate Validation	*
M Inappropriate Encoding for Output Context	*
H Arbitrary Code Injection	*
H Arbitrary Code Injection	*
M Improper Certificate Validation	*
M Link Following	*
M Improper Certificate Validation	*
M Improper Handling of Unexpected Data Type	*
M CRLF Injection	*
M Improper Certificate Validation	*
M Improper Handling of Inconsistent Special Elements	*
M XML Injection	*
H Allocation of Resources Without Limits or Throttling	*
H OS Command Injection	*
M Directory Traversal	*
M Directory Traversal	*
L Misinterpretation of Input	*
M Improper Input Validation	*
M XML External Entity (XXE) Injection	*
M Improper Validation of Certificate with Host Mismatch	*
H Directory Traversal	*
M Improper Resource Shutdown or Release	*
M Cross-site Request Forgery (CSRF)	*
M Improper Input Validation	*
M Directory Traversal	*
M Session Fixation	*
L Uncontrolled Recursion	*
L Authentication Bypass	*
M Allocation of Resources Without Limits or Throttling	*
M HTTP Response Splitting	*
M Information Exposure	*
M Improper Authentication	*
M Allocation of Resources Without Limits or Throttling	*
M Improper Validation of Syntactic Correctness of Input	*
M Allocation of Resources Without Limits or Throttling	*
M Integer Overflow or Wraparound	*
M Improper Validation of Specified Index, Position, or Offset in Input	*
M Allocation of Resources Without Limits or Throttling	*
H Resource Exhaustion	*
M Uncontrolled Recursion	*
H Resource Exhaustion	*
H Resource Exhaustion	*
M Improper Input Validation	*
L Out-of-bounds Write	*
M Deserialization of Untrusted Data	*
M SQL Injection	*
M Deserialization of Untrusted Data	*
M Improper Input Validation	*
L Improper Certificate Validation	*

Vulnerability

Vulnerable Version

Information Exposure