Skip to content
Fencer Vulns
critical 9.0

CVE-2021-45046 kev+ ransomware in the critical feed json

Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

published 2021-12-14 4 y ago modified 2026-10-02 37 d ago also GHSA-7rjr-3q55-vv33 , EUVD-2021-34769

cvss
9.0
version 3.1, CNA
cisa kev
Exploited
added 2023-05-01, used in ransomware
epss
100.0%
EPSS 100.0% chance of exploitation in 30 days, percentile 99.9%
public exploits
1
Metasploit, plus a Nuclei check

Summary

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • maven org.apache.logging.log4j:log4j-core 2.3.1, 2.12.2, 2.16.0
  • maven org.ops4j.pax.logging:pax-logging-log4j2 1.9.2, 1.10.8, 1.11.11, 2.0.12
  • Apache Software Foundation Apache Log4j 2.16.0
  • apache-log4j2 Debian 14, Debian 13, Debian 12 2.16.0-1

debian advisories DEBIAN-CVE-2021-45046

  • apache-log4j2 Ubuntu 20.04 LTS 2.16.0-0.20.04.1

ubuntu advisories UBUNTU-CVE-2021-45046

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • eap7-log4j jboss enterprise application platform 7.4 2.17.1-1.redhat_00001.1.el7eap
  • eap7-log4j jboss enterprise application platform 7.4 2.17.1-1.redhat_00001.1.el8eap
  • eap7-netty jboss enterprise application platform eus 7.3 4.1.63-4.Final_redhat_00002.1.el7eap
  • eap7-wildfly jboss enterprise application platform eus 7.3 7.3.12-3.GA_redhat_00002.1.el7eap
  • eap7-jettison jboss enterprise application platform eus 7.3 1.5.2-2.redhat_00002.1.el7eap
  • eap7-resteasy jboss enterprise application platform eus 7.3 3.11.6-1.Final_redhat_00001.1.el7eap
  • eap7-netty-all jboss enterprise application platform eus 7.3 4.1.63-4.Final_redhat_00002.1.el7eap
  • eap7-snakeyaml jboss enterprise application platform eus 7.3 1.33.0-1.SP1_redhat_00001.1.el7eap

red hat advisories RHSA-2025:1747RHSA-2025:1746RHSA-2022:1296RHSA-2022:1297

  • log4j openSUSE Tumbleweed 2.16.0-2.1
  • log4j openSUSE Leap 15.2 2.16.0-lp152.3.9.1
  • disruptor openSUSE Leap 15.2 3.4.4-lp152.2.3.1
  • jakarta-servlet openSUSE Leap 15.2 5.0.0-lp152.2.1
  • log4j openSUSE Leap 15.3 2.16.0-4.10.1
  • disruptor openSUSE Leap 15.3 3.4.4-3.3.1
  • jakarta-servlet openSUSE Leap 15.3 5.0.0-5.3.1
  • log4j openSUSE Leap 15.3 2.13.0-4.6.1

opensuse advisories openSUSE-SU-2024:11681-1openSUSE-SU-2021:1601-1openSUSE-SU-2021:4107-1openSUSE-SU-2021:4094-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-45046 updated cvss 8.1

log4j-core: DoS in log4j 2.x with thread context message pattern and context lookup pattern (incomplete fix for CVE-2021-44228)

  • Red Hat Integration Camel Quarkus 1 log4j-core
    affected: workaround, no fix available
  • Red Hat OpenStack Platform 13 (Queens) opendaylight
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat streams for Apache Kafka log4j-core
    affected: workaround, no fix available
  • Red Hat OpenShift Logging 5.0 openshift-logging/elasticsearch6-rhel8 v5.0.10-1
    fixed: vendor fix RHSA-2021:5137
  • Red Hat OpenShift Logging 5.1 openshift-logging/elasticsearch6-rhel8 v6.8.1-67
    fixed: vendor fix RHSA-2021:5128
  • Red Hat OpenShift Logging 5.2 openshift-logging/elasticsearch6-rhel8 v6.8.1-66
    fixed: vendor fix RHSA-2021:5127
  • Red Hat OpenShift Logging 5.3 openshift-logging/elasticsearch6-rhel8 v6.8.1-65
    fixed: vendor fix RHSA-2021:5129
  • Red Hat AMQ Streams 2.0.0
    fixed: vendor fix RHSA-2022:0138
show 15 more
  • Red Hat Data Grid 8.2.3
    fixed: vendor fix RHSA-2022:0205
  • Red Hat Fuse 7.8.2, 7.9.1, 7.10.1
    fixed: vendor fix RHSA-2022:0203
  • Red Hat Integration Camel Extensions for Quarkus 2.2
    fixed: vendor fix RHSA-2022:0222
  • Red Hat Integration Camel-K 1.6.3
    fixed: vendor fix RHSA-2022:0223
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-log4j 2.17.1-1.redhat_00001.1.el7eap
    fixed: vendor fix RHSA-2022:1296
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-log4j 2.17.1-1.redhat_00001.1.el8eap
    fixed: vendor fix RHSA-2022:1297
  • Red Hat JBoss Enterprise Application Platform log4j-api 2.17.1.redhat-00001, log4j-api 2.17.1.redhat-00002
    fixed: vendor fix RHSA-2022:0216
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-jettison 1.3.8-2.redhat_00002.1.ep7.el7, eap7-velocity 1.7.0-3.redhat_00006.1.ep7.el7, eap7-wildfly 7.1.9-2.GA_redhat_00002.1.ep7.el7, eap7-apache-cxf 3.1.16-4.redhat_00003.1.ep7.el7, eap7-netty 4.1.63-1.Final_redhat_00002.1.ep7.el7, eap7-apache-cxf-rt 3.1.16-4.redhat_00003.1.ep7.el7, +23 more
    fixed: vendor fix RHSA-2025:1746
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-jettison 1.5.2-2.redhat_00002.1.el7eap, eap7-wildfly 7.3.12-3.GA_redhat_00002.1.el7eap, eap7-netty 4.1.63-4.Final_redhat_00002.1.el7eap, eap7-jackson-core 2.10.4-2.redhat_00004.1.el7eap, eap7-snakeyaml 1.33.0-1.SP1_redhat_00001.1.el7eap, eap7-resteasy 3.11.6-1.Final_redhat_00001.1.el7eap, +35 more
    fixed: vendor fix RHSA-2025:1747
  • Red Hat OpenShift Container Platform 3.11 openshift3/ose-logging-elasticsearch5 v3.11.570-2.gd119820
    fixed: vendor fix RHSA-2021:5094
  • Red Hat OpenShift Container Platform 4.6 openshift4/ose-metering-hive v4.6.0-202112140546.p0.g8b9da97.assembly.stream, openshift4/ose-metering-presto v4.6.0-202112150545.p0.g190688a.assembly.art3595, openshift4/ose-logging-elasticsearch6 v4.6.0-202112132021.p0.g2a13a81.assembly.stream
    fixed: vendor fix RHSA-2021:5106
  • Red Hat OpenShift Container Platform 4.7 openshift4/ose-metering-hive v4.7.0-202112140553.p0.g091bb99.assembly.stream, openshift4/ose-metering-presto v4.7.0-202112150631.p0.gd502108.assembly.4.7.40
    fixed: vendor fix RHSA-2021:5107
  • Red Hat OpenShift Container Platform 4.8 openshift4/ose-metering-hive v4.8.0-202112132154.p0.g57dd03a.assembly.stream, openshift4/ose-metering-presto v4.8.0-202112150431.p0.g4b934ae.assembly.art3599
    fixed: vendor fix RHSA-2021:5108
  • Red Hat Vert.x 4.1.8
    fixed: vendor fix RHSA-2022:0083
  • Red Hat A-MQ Clients 2 log4j-core Red Hat OpenShift Logging 5.0 openshift-logging/fluentd-rhel8 v5.0.10-1, openshift-logging/kibana6-rhel8 v5.0.10-1, openshift-logging/eventrouter-rhel8 v5.0.10-1, openshift-logging/logging-curator5-rhel8 v5.0.10-1, openshift-logging/elasticsearch-proxy-rhel8 v5.0.10-1, openshift-logging/elasticsearch-rhel8-operator v5.0.10-1, +3 more Red Hat OpenShift Logging 5.1 openshift-logging/fluentd-rhel8 v1.7.4-72, openshift-logging/kibana6-rhel8 v6.8.1-75, openshift-logging/eventrouter-rhel8 v0.3.0-65, openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-68, openshift-logging/elasticsearch-rhel8-operator v5.1.5-3, openshift-logging/cluster-logging-rhel8-operator v5.1.5-3, +2 more Red Hat OpenShift Logging 5.2 openshift-logging/fluentd-rhel8 v1.7.4-71, openshift-logging/kibana6-rhel8 v6.8.1-74, openshift-logging/eventrouter-rhel8 v0.3.0-64, openshift-logging/logging-curator5-rhel8 v5.8.1-47, openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-67, openshift-logging/elasticsearch-rhel8-operator v5.2.4-4, +4 more Red Hat OpenShift Logging 5.3 openshift-logging/fluentd-rhel8 v1.7.4-70, openshift-logging/kibana6-rhel8 v6.8.1-73, openshift-logging/eventrouter-rhel8 v0.3.0-63, openshift-logging/logging-curator5-rhel8 v5.8.1-46, openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-66, openshift-logging/elasticsearch-rhel8-operator v5.3.1-3, +4 more Red Hat AMQ Broker 7 log4j-core
    +12 more products
    Red Hat build of Quarkus log4j-core Red Hat Decision Manager 7 log4j-core Red Hat Enterprise Linux 6 log4j, log4j-core, log4j-manual, log4j-javadoc Red Hat Enterprise Linux 7 log4j, log4j-core, log4j-manual, log4j-javadoc Red Hat Enterprise Linux 8 log4j12, log4j12-javadoc Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-xom 1.3.7-1.redhat_00001.1.el7eap, eap7-ecj 3.26.0-1.redhat_00002.1.el7eap, eap7-yasson 1.0.10-1.redhat_00001.1.el7eap, eap7-wildfly 7.4.4-3.GA_redhat_00011.1.el7eap, eap7-objectweb-asm 9.1.0-1.redhat_00002.1.el7eap, eap7-narayana 5.11.4-1.Final_redhat_00001.1.el7eap, +58 more Red Hat JBoss EAP 7.4 for RHEL 8 eap7-xom 1.3.7-1.redhat_00001.1.el8eap, eap7-ecj 3.26.0-1.redhat_00002.1.el8eap, eap7-yasson 1.0.10-1.redhat_00001.1.el8eap, eap7-wildfly 7.4.4-3.GA_redhat_00011.1.el8eap, eap7-objectweb-asm 9.1.0-1.redhat_00002.1.el8eap, eap7-narayana 5.11.4-1.Final_redhat_00001.1.el8eap, +56 more Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, ms 2.0.0, ms 2.1.2, +1763 more Red Hat JBoss Enterprise Application Platform 6 log4j-core Red Hat JBoss Enterprise Application Platform Expansion Pack log4j-core Red Hat OpenShift Container Platform 4.6 openshift4/ose-metering-hadoop v4.6.0-202112150545.p0.gf381145.assembly.art3595, openshift4/ose-elasticsearch-operator v4.6.0-202112140939.p0.gd421c69.assembly.art3594, openshift4/ose-metering-ansible-operator v4.6.0-202112140831.p0.gd74112d.assembly.art3594, openshift4/ose-metering-ansible-operator v4.6.0-202112150545.p0.gd74112d.assembly.art3595, openshift4/ose-elasticsearch-operator-bundle v4.6.0.202112140939.p0.gd421c69.assembly.art3594-1, openshift4/ose-metering-ansible-operator-bundle v4.6.0.202112140831.p0.gd74112d.assembly.art3594-1, +1 more Red Hat OpenShift Container Platform 4.7 openshift4/ose-metering-hadoop v4.7.0-202112150631.p0.g6046504.assembly.4.7.40, openshift4/ose-metering-ansible-operator v4.7.0-202112150631.p0.g3959be4.assembly.4.7.40, openshift4/ose-metering-ansible-operator-bundle v4.7.0.202112150631.p0.g3959be4.assembly.4.7.40-1
    not affected: vulnerable code not present

6 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (Metasploit auxiliary/scanner/http/log4shell_scanner)
  2. Published
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
3 y ago
Patch by
2023-05-22 (3 y ago)
Ransomware
Known to be used in ransomware campaigns
Required action
Apply updates per vendor instructions.
Vendor, product
Apache, Log4j2
CISA name
Apache Log4j2 Deserialization of Untrusted Data Vulnerability

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

  • T1059 Command and Scripting Interpreter primary impact
  • T1486 Data Encrypted for Impact secondary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
21 mo ago

Exploit prediction

99.98% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD 3.1 9.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CNA 3.1 9.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD 2.0 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P
GitHub 3.1 9.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
maven org.apache.logging.log4j:log4j-core
>=2.13.0, <2.16.0
>=2.4.0, <2.12.2
<2.3.1
2.16.0
2.12.2
2.3.1
maven org.ops4j.pax.logging:pax-logging-log4j2
>=1.8.0, <1.9.2
>=1.10.0, <1.10.8
>=1.11.0, <1.11.11
>=2.0.0, <2.0.12
1.9.2
1.10.8
1.11.11
2.0.12

Affected products

  • Apache Software Foundation Apache Log4j

Classification

Weakness
  • CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement
  • CWE-502 Deserialization of Untrusted Data
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.