Critical 9.0Known exploited (CISA KEV)Published Dec 14, 2021

CVE-2021-45046Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

Updated under an hour ago (Oct 28, 2026, 5:50 AM ET)

Does this affect you?

It affects Apache Software Foundation Apache Log4j and 55 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since May 1, 2023; federal agencies had to remediate by May 22, 2023, and it is known to be used in ransomware. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Apache Software Foundation Apache Log4j

Exploited in the last 30 days

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

CVSS: 9.0 CRITICAL (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE): CWE-917
Known exploited: Added to CISA KEV May 1, 2023; federal remediation due May 22, 2023; known ransomware useApply updates per vendor instructions.
EPSS (exploitation in the next 30 days): 99.98% (percentile 100)
Assigned by: apache
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Apache Software Foundation Apache Log4j apache_software_foundation:apache_log4j (from the name)	from Apache Log4j2 before 2.16.0	CNA record
apache log4j apache:log4j	from 2.0.1 before 2.12.2; from 2.13.0 before 2.16.0; 2.0; 2.0; 2.0; 2.0	NVD
cvat computer_vision_annotation_tool cvat:computer_vision_annotation_tool	all versions	NVD
intel audio_development_kit intel:audio_development_kit	all versions	NVD
intel datacenter_manager intel:datacenter_manager	all versions	NVD
intel genomics_kernel_library intel:genomics_kernel_library	all versions	NVD
intel oneapi intel:oneapi	all versions	NVD
intel secure_device_onboard intel:secure_device_onboard	all versions	NVD
intel sensor_solution_firmware_development_kit intel:sensor_solution_firmware_development_kit	all versions	NVD
intel system_debugger intel:system_debugger	all versions	NVD
1–10 of 56

References

References

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032	x-refsource-confirm, third-party-advisory
https://www.oracle.com/security-alerts/alert-cve-2021-44228.html	x-refsource-confirm, third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2021-44228	x-refsource-misc, not-applicable
http://www.openwall.com/lists/oss-security/2021/12/14/4	mailing-list, x-refsource-mlist, mitigation, third-party-advisory
https://logging.apache.org/log4j/2.x/security.html	x-refsource-confirm, mitigation, release-notes, vendor-advisory
https://www.kb.cert.org/vuls/id/930724	third-party-advisory, x-refsource-cert-vn, us-government-resource
https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf	x-refsource-confirm, third-party-advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.html	x-refsource-confirm, third-party-advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd	vendor-advisory, x-refsource-cisco, third-party-advisory
http://www.openwall.com/lists/oss-security/2021/12/15/3	mailing-list, x-refsource-mlist, third-party-advisory
1–10 of 22

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.