Security
فارسی
All products

org.apache.logging.log4j:log4j-core

Maven · Package
12 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Apache Log4j 1 to Log4j 2 bridge: silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden charactersCVE-2026-34479 · GHSA-H383-GMXW-35V2 org.apache.logging.log4j:log4j-coreRed Hat Data Grid 8/log4j-1.2-api MavenRed Hat Medium Fix reported
Incomplete fix for Apache Log4j vulnerabilityCVE-2021-45046 · GHSA-7RJR-3Q55-VV33 org.apache.logging.log4j:log4j-coreorg.ops4j.pax.logging:pax-logging-log4j2 MavenRed Hat Critical Fix reported
Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configurationCVE-2026-34477 · GHSA-6HG6-V5C8-FPHQ org.apache.logging.log4j:log4j-coreRed Hat AI Inference Server/redhat-user-workloads/rhaiis-cuda-ubi9-3-2-2 MavenRed Hat Medium Fix reported
Apache Log4j Core: log injection in `Rfc5424Layout` due to silent configuration incompatibilityCVE-2026-34478 · GHSA-445C-VH5M-36RJ org.apache.logging.log4j:log4j-coreRed Hat AI Inference Server/redhat-user-workloads/rhaiis-cuda-ubi9-3-3 MavenRed Hat Medium Fix reported
Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden charactersCVE-2026-34480 · GHSA-3PXV-7CMR-FJR4 org.apache.logging.log4j:log4j-coreRed Hat AI Inference Server/redhat-user-workloads/rhaiis-cuda-ubi9-3-3 MavenRed Hat Medium Fix reported
Apache Log4j does not verify the TLS hostname in its Socket AppenderCVE-2025-68161 · GHSA-VC5P-V9HR-52MJ org.apache.logging.log4j:log4j-coreLogging Subsystem for Red Hat OpenShift/log4j-core MavenRed Hat Medium Fix reported
Improper Input Validation and Injection in Apache Log4j2CVE-2021-44832 · GHSA-8489-44MV-GGJ8 org.apache.logging.log4j:log4j-coreorg.ops4j.pax.logging:pax-logging-log4j2 MavenRed Hat Medium Fix reported
Improper validation of certificate with host mismatch in Apache Log4j SMTP appenderCVE-2020-9488 · GHSA-VWQQ-5VRC-XW9H org.apache.logging.log4j:log4j-coreorg.apache.logging.log4j:log4j MavenRed Hat Low Fix reported
Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled RecursionCVE-2021-45105 · GHSA-P6XC-XR62-6R2G org.apache.logging.log4j:log4j-coreorg.ops4j.pax.logging:pax-logging-log4j2 MavenRed Hat High Fix reported
Remote code injection in Log4jCVE-2021-44228 · GHSA-JFH8-C2JP-5V3Q com.guicedee.services:log4j-coreorg.apache.logging.log4j:log4j-core MavenRed Hat Critical Fix reported
Apache Log4j 1.x (EOL) allows Denial of Service (DoS)CVE-2023-26464 · GHSA-VP98-W2P3-MV35 log4j:log4jorg.apache.logging.log4j:log4j-core MavenRed Hat High Fix reported
Deserialization of Untrusted Data in Log4jCVE-2017-5645 · GHSA-FXPH-Q3J8-MV87 org.apache.logging.log4j:log4j-coreorg.apache.logging.log4j:log4j MavenRed Hat Critical Fix reported