Skip to content
Fencer Vulns
high 7.5

CVE-2023-26464 json

Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender

published 2023-03-10 3 y ago modified 2026-06-17 4 mo ago also GHSA-vp98-w2p3-mv35 , EUVD-2023-1115

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.9%
EPSS 1.9% chance of exploitation in 30 days, percentile 79%
public exploits
0
none known

Summary

** UNSUPPORTED WHEN ASSIGNED **

When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested) hashmap or hashtable (depending on which logging component is in use) to be processed could exhaust the available memory in the virtual machine and achieve Denial of Service when the object is deserialized.

This issue affects Apache Log4j before 2. Affected users are recommended to update to Log4j 2.x.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Patch / fix

  • maven org.apache.logging.log4j:log4j-core 2.0
  • maven log4j:log4j 2.0
  • Apache Software Foundation Apache Log4j 2
  • apache log4j 2.0
  • jenkins ocp tools 4.11 2.401.1.1686831596-3.el8
  • jenkins-2-plugins ocp tools 4.11 4.11.1686831822-1.el8
  • eap7-netty jboss enterprise application platform 7.4 4.1.94-1.Final_redhat_00001.1.el8eap
  • eap7-wildfly jboss enterprise application platform 7.4 7.4.13-8.GA_redhat_00001.1.el8eap
  • eap7-resteasy jboss enterprise application platform 7.4 3.15.8-1.Final_redhat_00001.1.el8eap
  • eap7-undertow jboss enterprise application platform 7.4 2.2.26-1.SP1_redhat_00001.1.el8eap
  • eap7-hibernate jboss enterprise application platform 7.4 5.3.31-1.Final_redhat_00001.1.el8eap
  • eap7-netty-all jboss enterprise application platform 7.4 4.1.94-1.Final_redhat_00001.1.el8eap

red hat advisories RHSA-2024:10208RHSA-2024:10207RHSA-2023:3663RHSA-2023:5485RHSA-2023:5486RHSA-2023:5484

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-26464 updated cvss 7.5

log4j1-socketappender: DoS via hashmap logging

  • Red Hat Migration Toolkit for Applications 6 log4j Red Hat Migration Toolkit for Runtimes log4j
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Developer Tools and Services jenkins
    affected: workaround, no fix available
  • Red Hat Data Grid 8 log4j Red Hat Enterprise Linux 6 log4j, log4j-manual, log4j-javadoc Red Hat Enterprise Linux 7 log4j, log4j-manual, log4j-javadoc Red Hat JBoss Data Grid 7 log4j
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss Data Virtualization 6 log4j
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat JBoss Enterprise Application Platform 6 log4j
    affected: workaround, no fix planned “Will not fix”
  • Red Hat JBoss Fuse 6 log4j Red Hat JBoss Fuse Service Works 6 log4j Red Hat JBoss Web Server 3 log4j
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Dev Spaces devspaces/server-rhel8
    affected: workaround, no fix available
show 11 more
  • Red Hat Software Collections rh-maven36-log4j12, rh-maven36-log4j12-javadoc
    affected: workaround, no fix planned “Will not fix”
  • Red Hat support for Spring Boot log4j
    affected: workaround, no fix available
  • Red Hat streams for Apache Kafka log4j
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins 4.11.1686831822-1.el8
    fixed: vendor fix RHSA-2023:3663
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-wildfly 7.4.13-8.GA_redhat_00001.1.el7eap, eap7-netty 4.1.94-1.Final_redhat_00001.1.el7eap, eap7-bouncycastle 1.76.0-4.redhat_00001.1.el7eap, eap7-undertow 2.2.26-1.SP1_redhat_00001.1.el7eap, eap7-resteasy 3.15.8-1.Final_redhat_00001.1.el7eap, eap7-bouncycastle-pg 1.76.0-4.redhat_00001.1.el7eap, +95 more
    fixed: vendor fix RHSA-2023:5484
  • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-wildfly 7.4.13-8.GA_redhat_00001.1.el8eap, eap7-netty 4.1.94-1.Final_redhat_00001.1.el8eap, eap7-bouncycastle 1.76.0-4.redhat_00001.1.el8eap, eap7-undertow 2.2.26-1.SP1_redhat_00001.1.el8eap, eap7-resteasy 3.15.8-1.Final_redhat_00001.1.el8eap, eap7-bouncycastle-pg 1.76.0-4.redhat_00001.1.el8eap, +96 more
    fixed: vendor fix RHSA-2023:5485
  • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-wildfly 7.4.13-8.GA_redhat_00001.1.el9eap, eap7-netty 4.1.94-1.Final_redhat_00001.1.el9eap, eap7-bouncycastle 1.76.0-4.redhat_00001.1.el9eap, eap7-undertow 2.2.26-1.SP1_redhat_00001.1.el9eap, eap7-resteasy 3.15.8-1.Final_redhat_00001.1.el9eap, eap7-bouncycastle-pg 1.76.0-4.redhat_00001.1.el9eap, +93 more
    fixed: vendor fix RHSA-2023:5486
  • Red Hat JBoss Enterprise Application Platform wildfly-core-security 15.0.30.Final-redhat-00001
    fixed: vendor fix RHSA-2023:5488
  • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-avro 1.7.6-2.redhat_00003.1.ep7.el7, eap7-xalan-j2 2.7.1-26.redhat_00015.1.ep7.el7, eap7-wildfly 7.1.8-2.GA_redhat_00002.1.ep7.el7, eap7-h2database 1.4.197-2.redhat_00005.1.ep7.el7, eap7-bouncycastle 1.68.0-1.redhat_00005.1.ep7.el7, eap7-apache-cxf 3.1.16-3.SP1_redhat_00001.1.ep7.el7, +11 more
    fixed: vendor fix RHSA-2024:10208
  • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-avro 1.7.6-8.redhat_00003.1.el7eap, eap7-wss4j 2.3.3-2.redhat_00001.1.el7eap, eap7-xalan-j2 2.7.1-38.redhat_00015.1.el7eap, eap7-wildfly 7.3.11-4.GA_redhat_00002.1.el7eap, eap7-h2database 1.4.197-3.redhat_00004.1.el7eap, eap7-wss4j-policy 2.3.3-2.redhat_00001.1.el7eap, +41 more
    fixed: vendor fix RHSA-2024:10207
  • Red Hat A-MQ Clients 2 log4j Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/elasticsearch6-rhel8 Red Hat OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins 2.401.1.1686831596-3.el8 Red Hat OpenShift Service Mesh 2.1 log4j Red Hat Advanced Cluster Management for Kubernetes 2 log4j Red Hat AMQ Broker 7 log4j
    +10 more products
    Red Hat build of Quarkus log4j-api Red Hat Decision Manager 7 log4j Red Hat Enterprise Linux 8 slf4j, slf4j-ext, slf4j-jcl, slf4j-jdk14, jul-to-slf4j, slf4j-manual, +6 more Red Hat Enterprise Linux 9 log4j, log4j-jcl, log4j-slf4j Red Hat Integration Camel K 1 log4j Red Hat JBoss Enterprise Application Platform pom.xml, c3 0.6.0, c3 0.7.1, d3 5.9.2, fs 2.1.2, ip 2.0.0, +1550 more Red Hat JBoss Enterprise Application Platform 8 log4j Red Hat JBoss Enterprise Application Platform Expansion Pack log4j Red Hat JBoss Web Server 5 log4j Red Hat OpenShift Application Runtimes log4j
    not affected: vulnerable code not present

6 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.91% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven org.apache.logging.log4j:log4j-core
>=1.0.4, <2.0
2.0
maven log4j:log4j
>=1.0.4, <2.0
2.0

Affected products

  • Apache Software Foundation Apache Log4j
  • apache log4j

Classification

Weakness
  • CWE-502 Deserialization of Untrusted Data
  • CWE-400 Uncontrolled Resource Consumption
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.