Skip to content
CVE IDCVE-2021-44228GitHub advisory IDGHSA-jfh8-c2jp-5v3q

Remote code injection in Log4j

CVE-2021-44228 (GitHub advisory GHSA-jfh8-c2jp-5v3q) is a critical-severity vulnerability with a CVSS 3.1 base score of 10.0, classed as Improper Input Validation (CWE-20), in 5 packages, including org.apache.logging.log4j:log4j-core (Maven) and com.guicedee.services:log4j-core (Maven). Fixed versions: org.apache.logging.log4j:log4j-core 2.15.0, 2.12.2 or 2.3.1; org.ops4j.pax.logging:pax-logging-log4j2 1.9.2, 1.10.8, 1.11.10 or 2.0.11. CISA lists it as a known exploited vulnerability (added 10 Dec 2021).

Critical10.0Known exploitedFix availableGitHub reviewed

Published 10 Dec 2021Updated 22 Oct 2025

10.0CriticalCVSS 3.1
CVE ID
CVE-2021-44228
GHSA ID
GHSA-jfh8-c2jp-5v3q
EPSS
99.99%higher than 99.9% of CVEs
Weaknesses (CWE)
  • CWE-20Improper Input Validation
  • CWE-400Uncontrolled Resource Consumption
  • CWE-502Deserialization of Untrusted Data
  • CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
KEV status
Known exploitedAdded 10 Dec 2021
Published
10 Dec 2021
Updated
22 Oct 2025
Ecosystem
  • Maven
Assigned by (CNA)
apache

Summary

Source: OSV (GitHub advisory)

Log4j versions prior to 2.16.0 are subject to a remote code execution vulnerability via the ldap JNDI parser. As per Apache's Log4j security guide: Apache Log4j2 <=2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.16.0, this behavior has been disabled by default.

Log4j version 2.15.0 contained an earlier fix for the vulnerability, but that patch did not disable attacker-controlled JNDI lookups in all situations. For more information, see the Updated advice for version 2.16.0 section of this advisory.

Impact

Logging untrusted or user controlled data with a vulnerable version of Log4J may result in Remote Code Execution (RCE) against your application. This includes untrusted data included in logged errors such as exception traces, authentication failures, and other unexpected vectors of user controlled input.

Affected versions

Any Log4J version prior to v2.15.0 is affected to this specific issue.

The v1 branch of Log4J which is considered End Of Life (EOL) is vulnerable to other RCE vectors so the recommendation is to still update to 2.16.0 where possible.

Security releases

Additional backports of this fix have been made available in versions 2.3.1, 2.12.2, and 2.12.3

Affected packages

Only the org.apache.logging.log4j:log4j-core package is directly affected by this vulnerability. The org.apache.logging.log4j:log4j-api should be kept at the same version as the org.apache.logging.log4j:log4j-core package to ensure compatability if in use.

Remediation Advice

Updated advice for version 2.16.0

The Apache Logging Services team provided updated mitigation advice upon the release of version 2.16.0, which disables JNDI by default and completely removes support for message lookups. Even in version 2.15.0, lookups used in layouts to provide specific pieces of context information will still recursively resolve, possibly triggering JNDI lookups. This problem is being tracked as CVE-2021-45046. More information is available on the GitHub Security Advisory for CVE-2021-45046.

Users who want to avoid attacker-controlled JNDI lookups but cannot upgrade to 2.16.0 must ensure that no such lookups resolve to attacker-provided data and ensure that the the JndiLookup class is not loaded.

Please note that Log4J v1 is End Of Life (EOL) and will not receive patches for this issue. Log4J v1 is also vulnerable to other RCE vectors and we recommend you migrate to Log4J 2.16.0 where possible.

Technical details

Source: GitHub Advisory Database

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H

Critical10.0Base score from GitHub Advisory Database

Attack Vector AV
Network
Attack Complexity AC
Low
Privileges Required PR
None
User Interaction UI
None
Scope S
Changed
Confidentiality C
High
Integrity I
High
Availability A
High
Exploit Code Maturity E
High

CISA SSVC decision points

Exploitation
active
Exploited in the wild
Automatable
yes
Attackers can automate this at scale
Technical impact
total
Full control of the affected system

CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.

CISA required action

For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.

Federal agencies must remediate by 24 Dec 2021. Used in ransomware campaigns.

Affected packages

Source: OSV (GitHub advisory)

  • org.apache.logging.log4j:log4j-core
    Maven
    pkg:maven/org.apache.logging.log4j/log4j-core
    Affected versions
    >= 2.13.0, < 2.15.0
    >= 2.4, < 2.12.2
    >= 2.0-beta9, < 2.3.1
    Fixed in
    2.15.0
    2.12.2
    2.3.1
    Show 33 listed versions
    • 2.13.0
    • 2.13.1
    • 2.13.2
    • 2.13.3
    • 2.14.0
    • 2.14.1
    • 2.0
    • 2.0-beta9
    • 2.0-rc1
    • 2.0-rc2
    • 2.0.1
    • 2.0.2
  • com.guicedee.services:log4j-core
    Maven
    pkg:maven/com.guicedee.services/log4j-core
    Affected versions
    <= 1.2.1.2-jre17
    Fixed in
    None after 1.2.1.2-jre17
    Show 362 listed versions
    • 1.0.10.0
    • 1.0.10.0-jre13
    • 1.0.10.0-jre14
    • 1.0.10.1
    • 1.0.10.1-jre14
    • 1.0.10.3
    • 1.0.10.3-jre14
    • 1.0.10.4
    • 1.0.10.4-jre12
    • 1.0.10.4-jre13
    • 1.0.10.4-jre14
    • 1.0.11.0-jre14
  • org.xbib.elasticsearch:log4j
    Maven
    pkg:maven/org.xbib.elasticsearch/log4j
    Affected versions
    = 6.3.2.1
    Fixed in
    No fix yet
    Show 1 listed version
    • 6.3.2.1
  • uk.co.nichesolutions.logging.log4j:log4j-core
    Maven
    pkg:maven/uk.co.nichesolutions.logging.log4j/log4j-core
    Affected versions
    = 2.6.3-CUSTOM
    Fixed in
    No fix yet
    Show 1 listed version
    • 2.6.3-CUSTOM
  • org.ops4j.pax.logging:pax-logging-log4j2
    Maven
    pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2
    Affected versions
    >= 1.8.0, < 1.9.2
    >= 1.10.0, < 1.10.8
    >= 1.11.0, < 1.11.10
    >= 2.0.0, < 2.0.11
    Fixed in
    1.9.2
    1.10.8
    1.11.10
    2.0.11
    Show 39 listed versions
    • 1.8.0
    • 1.8.1
    • 1.8.2
    • 1.8.3
    • 1.8.4
    • 1.8.5
    • 1.8.6
    • 1.8.7
    • 1.9.0
    • 1.9.1
    • 1.10.0
    • 1.10.1

Fix

Source: OSV (GitHub advisory)

Fix available

  • org.apache.logging.log4j:log4j-core: upgrade to 2.15.0, 2.12.2 or 2.3.1, depending on your release line
  • org.ops4j.pax.logging:pax-logging-log4j2: upgrade to 1.9.2, 1.10.8, 1.11.10 or 2.0.11, depending on your release line

Not fixed yet for: com.guicedee.services:log4j-core, org.xbib.elasticsearch:log4j, uk.co.nichesolutions.logging.log4j:log4j-core.

Patch commits

  • #608Pull requestgithub.com/apache/logging-log4j2

Release commits

The commits each fixed release tag points at. They usually bump the version rather than contain the fix itself.

  • 38513a7Release commit2.3.1github.com/apache/logging-log4j2
  • ad361d2Release commit2.12.2github.com/apache/logging-log4j2
  • c30a139Release commit2.15.0github.com/apache/logging-log4j2

Vulnerability intelligence

References

Credits

  • ppkarwaszanalyst
  • This issue was discovered by Chen Zhaojun of Alibaba Cloud Security Team.

Questions about CVE-2021-44228

What is the GHSA ID for CVE-2021-44228?
GitHub tracks CVE-2021-44228 as GHSA-jfh8-c2jp-5v3q.
What is the CVSS score of CVE-2021-44228?
CVE-2021-44228 has a CVSS 3.1 base score of 10.0 (Critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H.
Which versions are affected by CVE-2021-44228?
org.apache.logging.log4j:log4j-core (Maven): >= 2.13.0, < 2.15.0; >= 2.4, < 2.12.2; >= 2.0-beta9, < 2.3.1. com.guicedee.services:log4j-core (Maven): <= 1.2.1.2-jre17. org.xbib.elasticsearch:log4j (Maven): = 6.3.2.1. uk.co.nichesolutions.logging.log4j:log4j-core (Maven): = 2.6.3-CUSTOM. org.ops4j.pax.logging:pax-logging-log4j2 (Maven): >= 1.8.0, < 1.9.2; >= 1.10.0, < 1.10.8; >= 1.11.0, < 1.11.10; >= 2.0.0, < 2.0.11.
How do I fix CVE-2021-44228?
Upgrade each package to its fixed version: org.apache.logging.log4j:log4j-core 2.15.0, 2.12.2 or 2.3.1; org.ops4j.pax.logging:pax-logging-log4j2 1.9.2, 1.10.8, 1.11.10 or 2.0.11. The fix is in pull request #608.
What is the Package URL (PURL) for CVE-2021-44228?
The affected packages' PURLs are pkg:maven/org.apache.logging.log4j/log4j-core, pkg:maven/com.guicedee.services/log4j-core, pkg:maven/org.xbib.elasticsearch/log4j, pkg:maven/uk.co.nichesolutions.logging.log4j/log4j-core and pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2.
Is CVE-2021-44228 exploited in the wild?
CISA lists it as a known exploited vulnerability (added 10 Dec 2021). CISA's SSVC assessment rates exploitation as "active". EPSS estimates a 99.99% chance of exploitation in the next 30 days, higher than 99.9% of CVEs.

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 1 day ago (15 Oct 2026, 02:56 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
SSVC
CVE.org
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.