CVE-2021-44228criticalunder attackransomwareCWE-20 CWE-400 CWE-502

CVE-2021-44228: critical vulnerability in Apache Log4j2

Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Published 10 Dec 2021 · Updated 21 Oct 2025

Follow this CVE + Monitor Apache Log4j + Monitor org.apache.logging.log4j:log4j-core

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 4 threat group(s) use it.

ssvc Actcvss 10epss 100%

from disclosure to weaponsame day

Published on NVDDec 10

1st PoCDec 9

metasploitDec 9

CISA KEVDec 10

Who exploits it — 4

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

Ransomwarekarakurt CISA

APT / StateMagic Hound🇮🇷 MITRE ATT&CK

APT / StateSea Turtle MITRE ATT&CK

Ransomwarenightsky🇨🇳 leak site

What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗

Affected

2 products (3 components)

Red Hat OpenStack Platform 13 (Queens) · Red Hat Integration Camel Quarkus 1

workaround: For Log4j versions >=2.10 set the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true For Log4j versions >=2.7 and <=2.14.1 all PatternLayout patterns can be modified to specify the message…

Fixed

21 products (122 components)

Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server · Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server · Red Hat OpenShift Container Platform 4.6 · OpenShift Logging 5.0 · OpenShift Logging 5.1 · and others 16

fix ↗

Not affected

22 products (143 components) — because the vulnerable code is not present in the product

OpenShift Logging 5.2 · OpenShift Logging 5.3 · OpenShift Logging 5.0 · OpenShift Logging 5.1 · Red Hat OpenShift Container Platform 4.6 · and others 17

Action required by CISAfederal deadline: 2021-12-24

For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.

In short

Apache Log4j2 allows attackers to execute arbitrary code by injecting malicious commands into log messages. If an application uses a vulnerable version of Log4j2 and logs user-controlled data, an attacker can trigger code execution from remote servers.

Technical detail

CVE-2021-44228 exploits unsafe JNDI (Java Naming and Directory Interface) lookups in Log4j2 versions 2.0-beta9 through 2.15.0 when message lookup substitution is enabled. An attacker controlling log message content can inject JNDI expressions that load and execute arbitrary code from attacker-controlled LDAP or RMI endpoints. This requires the application to log attacker-influenced data without sanitization.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

Apache Software Foundation · Apache Log4j2

public PoCs found — 653

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Related CVEs — Apache Log4j2

In the same product, most dangerous first.

CVE-2021-45105MEDIUMApache Log4j2 does not always protect from infinite recursion in lookup evaluationEPSS 100.0%CVE-2021-44832MEDIUMApache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configurationEPSS 97.9%

References