Back to CVE records
Critical 9.8Published Apr 17, 2017
CVE-2017-5645In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that,…
Updated under an hour ago ()
Does this affect you?
It affects Apache Software Foundation Apache Log4j and 59 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Start free and add your stack
Free account, 1 product
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
- CVSS
- 9.8 CRITICAL (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- apache
- NVD analysis
- Modified
- Record last updated
- Oct 8, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Apache Software Foundation Apache Log4j apache_software_foundation:apache_log4j (from the name) | All versions between 2.0-alpha1 and 2.8.1 | CNA record |
apache log4j apache:log4j | from 2.0 before 2.8.2 | NVD |
netapp oncommand_api_services netapp:oncommand_api_services | all versions | NVD |
netapp oncommand_insight netapp:oncommand_insight | all versions | NVD |
netapp oncommand_workflow_automation netapp:oncommand_workflow_automation | all versions | NVD |
netapp service_level_manager netapp:service_level_manager | all versions | NVD |
netapp snapcenter netapp:snapcenter | all versions | NVD |
netapp storage_automation_store netapp:storage_automation_store | all versions | NVD |
redhat fuse redhat:fuse | 1.0 | NVD |
redhat enterprise_linux redhat:enterprise_linux | 6.0; 6.7; 7.0; 7.3; 7.4; 7.5; 7.6 | NVD |
redhat enterprise_linux_desktop redhat:enterprise_linux_desktop | 7.0 | NVD |
redhat enterprise_linux_server redhat:enterprise_linux_server | 7.0 | NVD |
redhat enterprise_linux_server_aus redhat:enterprise_linux_server_aus | 7.4; 7.6 | NVD |
redhat enterprise_linux_server_eus redhat:enterprise_linux_server_eus | 7.4; 7.5; 7.6 | NVD |
redhat enterprise_linux_server_tus redhat:enterprise_linux_server_tus | 7.4; 7.6 | NVD |
redhat enterprise_linux_workstation redhat:enterprise_linux_workstation | 7.0 | NVD |
oracle api_gateway oracle:api_gateway | 11.1.2.4.0 | NVD |
oracle application_testing_suite oracle:application_testing_suite | 13.3.0.1 | NVD |
oracle autovue_vuelink_integration oracle:autovue_vuelink_integration | 21.0.0; 21.0.1 | NVD |
oracle banking_platform oracle:banking_platform | 2.6.0; 2.6.1; 2.6.2 | NVD |
oracle bi_publisher oracle:bi_publisher | 11.1.1.7.0; 11.1.1.9.0; 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle communications_converged_application_server_-_service_controller oracle:communications_converged_application_server_-_service_controller | 6.1 | NVD |
oracle communications_instant_messaging_server oracle:communications_instant_messaging_server | 10.0.1.3.0 | NVD |
oracle communications_interactive_session_recorder oracle:communications_interactive_session_recorder | from 6.0 through 6.2 | NVD |
oracle communications_messaging_server oracle:communications_messaging_server | before 8.0.2 | NVD |
oracle communications_network_integrity oracle:communications_network_integrity | from 7.3.2 through 7.3.6 | NVD |
oracle communications_online_mediation_controller oracle:communications_online_mediation_controller | 6.1 | NVD |
oracle communications_pricing_design_center oracle:communications_pricing_design_center | 11.1; 12.0 | NVD |
oracle communications_service_broker oracle:communications_service_broker | 6.0 | NVD |
oracle communications_webrtc_session_controller oracle:communications_webrtc_session_controller | before 7.2 | NVD |
oracle configuration_manager oracle:configuration_manager | 12.1.2.0.2; 12.1.2.0.5 | NVD |
oracle endeca_information_discovery_studio oracle:endeca_information_discovery_studio | 3.2.0 | NVD |
oracle enterprise_data_quality oracle:enterprise_data_quality | 12.2.1.3.0 | NVD |
oracle enterprise_manager_base_platform oracle:enterprise_manager_base_platform | 12.1.0.5; 13.2.0.0 | NVD |
oracle enterprise_manager_for_fusion_middleware oracle:enterprise_manager_for_fusion_middleware | 12.1.0.5; 13.2.0.0 | NVD |
oracle enterprise_manager_for_mysql_database oracle:enterprise_manager_for_mysql_database | through 13.2.2.0.0 | NVD |
oracle enterprise_manager_for_oracle_database oracle:enterprise_manager_for_oracle_database | 12.1.0.8; 13.2.2 | NVD |
oracle enterprise_manager_for_peoplesoft oracle:enterprise_manager_for_peoplesoft | 13.1.1.1; 13.2.1.1 | NVD |
oracle financial_services_analytical_applications_infrastructure oracle:financial_services_analytical_applications_infrastructure | from 7.3.3.0.0 through 7.3.3.0.2; from 8.0.0.0.0 through 8.0.7.0.0 | NVD |
oracle financial_services_behavior_detection_platform oracle:financial_services_behavior_detection_platform | from 8.0.0.0.0 through 8.0.4.0.0; 6.1.1 | NVD |
oracle financial_services_hedge_management_and_ifrs_valuations oracle:financial_services_hedge_management_and_ifrs_valuations | 8.0.4; 8.0.5 | NVD |
oracle financial_services_lending_and_leasing oracle:financial_services_lending_and_leasing | from 14.1.0 through 14.8.0; 12.5.0 | NVD |
oracle financial_services_loan_loss_forecasting_and_provisioning oracle:financial_services_loan_loss_forecasting_and_provisioning | 8.0.4; 8.0.5 | NVD |
oracle financial_services_profitability_management oracle:financial_services_profitability_management | from 8.0.0.0.0 through 8.0.7.0.0; 6.1.1 | NVD |
oracle financial_services_regulatory_reporting_with_agilereporter oracle:financial_services_regulatory_reporting_with_agilereporter | 8.0.9.2.0 | NVD |
oracle flexcube_investor_servicing oracle:flexcube_investor_servicing | 12.0.4; 12.1.0; 12.3.0; 12.4.0; 14.0.0 | NVD |
oracle fusion_middleware_mapviewer oracle:fusion_middleware_mapviewer | 12.2.1.2; 12.2.1.3 | NVD |
oracle goldengate oracle:goldengate | 12.3.2.1.1 | NVD |
oracle goldengate_application_adapters oracle:goldengate_application_adapters | 12.3.2.1.1 | NVD |
oracle identity_analytics oracle:identity_analytics | 11.1.1.5.8 | NVD |
oracle identity_management_suite oracle:identity_management_suite | 11.1.2.3.0; 12.2.1.3.0 | NVD |
oracle identity_manager_connector oracle:identity_manager_connector | 9.0 | NVD |
oracle in-memory_performance-driven_planning oracle:in-memory_performance-driven_planning | 12.1; 12.2 | NVD |
oracle instantis_enterprisetrack oracle:instantis_enterprisetrack | from 17.1 through 17.3 | NVD |
oracle insurance_calculation_engine oracle:insurance_calculation_engine | 10.1.1; 10.2.1 | NVD |
oracle insurance_policy_administration oracle:insurance_policy_administration | 10.0; 10.1; 10.2; 11.0 | NVD |
oracle insurance_rules_palette oracle:insurance_rules_palette | 10.0; 10.1; 10.2; 11.0; 11.1 | NVD |
oracle jd_edwards_enterpriseone_tools oracle:jd_edwards_enterpriseone_tools | 4.0.1.0; 9.2 | NVD |
oracle jdeveloper oracle:jdeveloper | 11.1.1.9.0; 12.1.3.0.0; 12.2.1.3.0 | NVD |
oracle mysql_enterprise_monitor oracle:mysql_enterprise_monitor | from 3.4.0.0 through 3.4.7.4297; from 4.0.0.0 through 4.0.4.5235; from 8.0.0.0.0 through 8.0.0.8131 | NVD |
References
- https://access.redhat.com/errata/RHSA-2017:2888vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2017:2809vendor-advisory, x-refsource-redhat
- http://www.securityfocus.com/bid/97702vdb-entry, x-refsource-bid
- http://www.securitytracker.com/id/1041294vdb-entry, x-refsource-sectrack
- https://access.redhat.com/errata/RHSA-2017:2810vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2017:1801vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2017:2889vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2017:2635vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2017:2638vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2017:1417vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2017:2423vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2017:2808vendor-advisory, x-refsource-redhat
- http://www.securitytracker.com/id/1040200vdb-entry, x-refsource-sectrack
- https://access.redhat.com/errata/RHSA-2017:2636vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2017:3399vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2017:2637vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2017:3244vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2017:3400vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2017:2633vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2017:2811vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2017:1802vendor-advisory, x-refsource-redhat
- https://access.redhat.com/errata/RHSA-2019:1545vendor-advisory, x-refsource-redhat
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/e8fb7d76a244ee997ba4b217d6171227f7c2521af8c7c5b16cba27bc%40%3Cdev.logging.apache.org%3Emailing-list, x-refsource-mlist
- https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3Emailing-list, x-refsource-mlist
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.