Homepage

org.apache.logging.log4j:log4j-core vulnerabilities

Licenses: Apache-2.0
Published: 13 years ago Last updated: 2 months ago Latest version: 2.25.2 Latest non-vulnerable version: 3.0.0-beta3

License

Apache-2.0[2.0-alpha1,);
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.apache.logging.log4j:log4j-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free
VulnerabilityVulnerable Version
  • M
Arbitrary Code Execution

[2.0-beta7,2.3.2)[2.4,2.12.4)[2.13.0,2.17.1)
  • H
Denial of Service (DoS)

[2.0-beta9,2.3.1)[2.4,2.12.3)[2.13.0,2.17.0)
  • C
Remote Code Execution (RCE)

[2.0-beta9,2.3.1)[2.4,2.12.2)[2.13.0,2.16.0)
  • C
Remote Code Execution (RCE)

[2.0-beta9,2.3.1)[2.4,2.12.2)[2.13.0,2.15.0)
  • L
Man-in-the-Middle (MitM)

[,2.13.2)
  • C
Deserialization of Untrusted Data

[,2.8.2)

Package versions

73 VERSIONS IN TOTAL See all versions
versionpublisheddirect vulnerabilities
3.0.0-beta39 Nov, 2024
  • 0
    C
  • 0
    H
  • 0
    M
  • 0
    L
3.0.0-beta217 Feb, 2024
  • 0
    C
  • 0
    H
  • 0
    M
  • 0
    L
3.0.0-beta119 Dec, 2023
  • 0
    C
  • 0
    H
  • 0
    M
  • 0
    L
3.0.0-alpha118 Jun, 2023
  • 0
    C
  • 0
    H
  • 0
    M
  • 0
    L
2.25.218 Sep, 2025
  • 0
    C
  • 0
    H
  • 0
    M
  • 0
    L
2.25.15 Jul, 2025
  • 0
    C
  • 0
    H
  • 0
    M
  • 0
    L
2.25.013 Jun, 2025
  • 0
    C
  • 0
    H
  • 0
    M
  • 0
    L
2.24.310 Dec, 2024
  • 0
    C
  • 0
    H
  • 0
    M
  • 0
    L
2.24.218 Nov, 2024
  • 0
    C
  • 0
    H
  • 0
    M
  • 0
    L
2.24.124 Sep, 2024
  • 0
    C
  • 0
    H
  • 0
    M
  • 0
    L