CVE-2021-45105
Apache Software Foundation Apache Log4j2
Summary
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of…
Published: 2021-12-18
Analysis
🟠 High — imminent exploitation
Weakness: Improper Input Validation (CWE-20). Fails to validate input before using it.
How it's exploited: Exploitable over the network (internet-reachable), unauthenticated, no user interaction, with high complexity.
Impact: Confidentiality none · Integrity none · Availability high.
Status: Exploit probability (EPSS, 30 days): 100% — high.
- Apply the vendor patch according to risk priority.
- Reduce exposure: keep it off the internet; firewall, VPN or network segmentation.
- Detect: turn this CVE into detection rules.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
The vector encodes how it's exploited (translated above, in the analysis). Break it down in the CVSS tool →
Sources: CISA KEV · EPSS · FIRST.org · NVD. Analysis derived from the CVSS vector and exploitation status (no AI). Informational; always verify against the vendor's official advisory.