Back to CVE records
Medium 5.9HealthcarePublished Dec 18, 2021
CVE-2021-45105Apache Log4j2 does not always protect from infinite recursion in lookup evaluation
Updated under an hour ago ()
Does this affect you?
It affects Apache Software Foundation Apache Log4j2 and 59 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 100.00%, higher than 100% of scored CVEs. That is high: schedule it on your emergency patch path.
Do this next
Start free and add your stack
Free account, 1 product
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
- CVSS
- 5.9 MEDIUM (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- CWE-20, CWE-674
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 100.00% (percentile 100)
- Assigned by
- apache
- NVD analysis
- Modified
- Record last updated
- May 29, 2026
- First seen by InfoSec Signals
- Oct 12, 2026
Affected products
Apache Software Foundation Apache Log4j2 apache_software_foundation:apache_log4j2 (from the name) | from log4j-core before 2.17.0; affected at 2.13.0, fixed at 2.12.3, affected at 2.4, fixed at 2.3.1, affected at 2.0-alpha1 | CNA record |
apache log4j apache:log4j | from 2.0 before 2.3.1; from 2.4 before 2.12.3; from 2.13.0 through 2.16.0 | NVD |
netapp cloud_manager netapp:cloud_manager | all versions | NVD |
debian debian_linux debian:debian_linux | 10.0; 11.0 | NVD |
sonicwall email_security sonicwall:email_security | through 10.0.12 | NVD |
sonicwall network_security_manager sonicwall:network_security_manager | from 2.0 before 3.0; from 2.0 before 3.0 | NVD |
sonicwall web_application_firewall sonicwall:web_application_firewall | from 3.0.0 before 3.1.0 | NVD |
sonicwall 6bk1602-0aa12-0tp0_firmware sonicwall:6bk1602-0aa12-0tp0_firmware | before 2.7.0 | NVD |
sonicwall 6bk1602-0aa22-0tp0_firmware sonicwall:6bk1602-0aa22-0tp0_firmware | before 2.7.0 | NVD |
sonicwall 6bk1602-0aa32-0tp0_firmware sonicwall:6bk1602-0aa32-0tp0_firmware | before 2.7.0 | NVD |
sonicwall 6bk1602-0aa42-0tp0_firmware sonicwall:6bk1602-0aa42-0tp0_firmware | before 2.7.0 | NVD |
sonicwall 6bk1602-0aa52-0tp0_firmware sonicwall:6bk1602-0aa52-0tp0_firmware | before 2.7.0 | NVD |
oracle agile_engineering_data_management oracle:agile_engineering_data_management | 6.2.1.0 | NVD |
oracle agile_plm_mcad_connector oracle:agile_plm_mcad_connector | 3.6 | NVD |
oracle agile_product_lifecycle_management oracle:agile_product_lifecycle_management | 9.3.6 | NVD |
oracle autovue_for_agile_product_lifecycle_management oracle:autovue_for_agile_product_lifecycle_management | 21.0.2 | NVD |
oracle banking_deposits_and_lines_of_credit_servicing oracle:banking_deposits_and_lines_of_credit_servicing | 2.12.0 | NVD |
oracle banking_enterprise_default_management oracle:banking_enterprise_default_management | 2.7.1; 2.12.0 | NVD |
oracle banking_loans_servicing oracle:banking_loans_servicing | 2.12.0 | NVD |
oracle banking_party_management oracle:banking_party_management | 2.7.0 | NVD |
oracle banking_payments oracle:banking_payments | 14.5 | NVD |
oracle banking_platform oracle:banking_platform | 2.6.2; 2.7.1; 2.12.0 | NVD |
oracle banking_trade_finance oracle:banking_trade_finance | 14.5 | NVD |
oracle banking_treasury_management oracle:banking_treasury_management | 14.5 | NVD |
oracle business_intelligence oracle:business_intelligence | 5.5.0.0.0 | NVD |
oracle communications_asap oracle:communications_asap | 7.3 | NVD |
oracle communications_billing_and_revenue_management oracle:communications_billing_and_revenue_management | 12.0.0.4; 12.0.0.5 | NVD |
oracle communications_cloud_native_core_console oracle:communications_cloud_native_core_console | 1.9.0 | NVD |
oracle communications_cloud_native_core_network_function_cloud_native_environment oracle:communications_cloud_native_core_network_function_cloud_native_environment | 1.10.0 | NVD |
oracle communications_cloud_native_core_network_repository_function oracle:communications_cloud_native_core_network_repository_function | 1.15.0; 1.15.1 | NVD |
oracle communications_cloud_native_core_network_slice_selection_function oracle:communications_cloud_native_core_network_slice_selection_function | 1.8.0 | NVD |
oracle communications_cloud_native_core_policy oracle:communications_cloud_native_core_policy | 1.15.0 | NVD |
oracle communications_cloud_native_core_security_edge_protection_proxy oracle:communications_cloud_native_core_security_edge_protection_proxy | 1.7.0 | NVD |
oracle communications_cloud_native_core_service_communication_proxy oracle:communications_cloud_native_core_service_communication_proxy | 1.15.0 | NVD |
oracle communications_cloud_native_core_unified_data_repository oracle:communications_cloud_native_core_unified_data_repository | 1.15.0 | NVD |
oracle communications_convergence oracle:communications_convergence | 3.0.2.2.0; 3.0.3.0 | NVD |
oracle communications_convergent_charging_controller oracle:communications_convergent_charging_controller | from 12.0.1.0.0 through 12.0.4.0.0; 6.0.1.0.0 | NVD |
oracle communications_diameter_signaling_router oracle:communications_diameter_signaling_router | from 8.3.0.0 through 8.5.1.0 | NVD |
oracle communications_eagle_element_management_system oracle:communications_eagle_element_management_system | 46.6 | NVD |
oracle communications_eagle_ftp_table_base_retrieval oracle:communications_eagle_ftp_table_base_retrieval | 4.5 | NVD |
oracle communications_element_manager oracle:communications_element_manager | before 9.0 | NVD |
oracle communications_evolved_communications_application_server oracle:communications_evolved_communications_application_server | 7.1 | NVD |
oracle communications_interactive_session_recorder oracle:communications_interactive_session_recorder | 6.3; 6.4 | NVD |
oracle communications_ip_service_activator oracle:communications_ip_service_activator | 7.4.0 | NVD |
oracle communications_messaging_server oracle:communications_messaging_server | 8.1 | NVD |
oracle communications_network_charging_and_control oracle:communications_network_charging_and_control | from 12.0.1.0.0 through 12.0.4.0.0; 6.0.1.0.0 | NVD |
oracle communications_network_integrity oracle:communications_network_integrity | 7.3.6 | NVD |
oracle communications_performance_intelligence_center oracle:communications_performance_intelligence_center | 10.4.0.3 | NVD |
oracle communications_pricing_design_center oracle:communications_pricing_design_center | 12.0.0.4; 12.0.0.5 | NVD |
oracle communications_service_broker oracle:communications_service_broker | 6.2 | NVD |
oracle communications_services_gatekeeper oracle:communications_services_gatekeeper | 7.0 | NVD |
oracle communications_session_report_manager oracle:communications_session_report_manager | before 9.0 | NVD |
oracle communications_session_route_manager oracle:communications_session_route_manager | before 9.0 | NVD |
oracle communications_unified_inventory_management oracle:communications_unified_inventory_management | 7.3.5; 7.4.1; 7.4.2 | NVD |
oracle communications_user_data_repository oracle:communications_user_data_repository | 12.4 | NVD |
oracle communications_webrtc_session_controller oracle:communications_webrtc_session_controller | 7.2.0.0; 7.2.1 | NVD |
oracle data_integrator oracle:data_integrator | 12.2.1.3.0; 12.2.1.4.0 | NVD |
oracle e-business_suite oracle:e-business_suite | 12.2 | NVD |
oracle enterprise_manager_base_platform oracle:enterprise_manager_base_platform | 13.4.0.0; 13.5.0.0 | NVD |
oracle enterprise_manager_for_peoplesoft oracle:enterprise_manager_for_peoplesoft | 13.4.1.1; 13.5.1.1 | NVD |
References
- https://logging.apache.org/log4j/2.x/security.htmlx-refsource-misc, release-notes, vendor-advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032x-refsource-confirm, third-party-advisory
- https://www.kb.cert.org/vuls/id/930724third-party-advisory, x-refsource-cert-vn, us-government-resource
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbdvendor-advisory, x-refsource-cisco, third-party-advisory
- http://www.openwall.com/lists/oss-security/2021/12/19/1mailing-list, x-refsource-mlist, mitigation, third-party-advisory
- https://www.debian.org/security/2021/dsa-5024vendor-advisory, x-refsource-debian, third-party-advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdfx-refsource-confirm, third-party-advisory
- https://security.netapp.com/advisory/ntap-20211218-0001/x-refsource-confirm, third-party-advisory
- https://www.zerodayinitiative.com/advisories/ZDI-21-1541/x-refsource-misc, third-party-advisory, vdb-entry
- https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdfx-refsource-confirm, third-party-advisory
- https://www.oracle.com/security-alerts/cpujan2022.htmlx-refsource-misc, patch, third-party-advisory
- https://www.oracle.com/security-alerts/cpuapr2022.htmlx-refsource-misc, patch, third-party-advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlx-refsource-misc, third-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.