Medium 5.9HealthcarePublished Dec 18, 2021

CVE-2021-45105Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

Updated under an hour ago (Oct 27, 2026, 9:00 PM ET)

Does this affect you?

It affects Apache Software Foundation Apache Log4j2 and 59 other products. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 100.00%, higher than 100% of scored CVEs. That is high: schedule it on your emergency patch path.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Apache Software Foundation Apache Log4j2

Exploited in the last 30 days

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

CVSS: 5.9 MEDIUM (v3.1, CISA ADP)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-20, CWE-674
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 100.00% (percentile 100)
Assigned by: apache
NVD analysis: Modified
Record last updated: May 29, 2026
First seen by InfoSec Signals: Oct 12, 2026

Affected products

Affected products

Apache Software Foundation Apache Log4j2 apache_software_foundation:apache_log4j2 (from the name)	from log4j-core before 2.17.0; affected at 2.13.0, fixed at 2.12.3, affected at 2.4, fixed at 2.3.1, affected at 2.0-alpha1	CNA record
apache log4j apache:log4j	from 2.0 before 2.3.1; from 2.4 before 2.12.3; from 2.13.0 through 2.16.0	NVD
netapp cloud_manager netapp:cloud_manager	all versions	NVD
debian debian_linux debian:debian_linux	10.0; 11.0	NVD
sonicwall email_security sonicwall:email_security	through 10.0.12	NVD
sonicwall network_security_manager sonicwall:network_security_manager	from 2.0 before 3.0; from 2.0 before 3.0	NVD
sonicwall web_application_firewall sonicwall:web_application_firewall	from 3.0.0 before 3.1.0	NVD
sonicwall 6bk1602-0aa12-0tp0_firmware sonicwall:6bk1602-0aa12-0tp0_firmware	before 2.7.0	NVD
sonicwall 6bk1602-0aa22-0tp0_firmware sonicwall:6bk1602-0aa22-0tp0_firmware	before 2.7.0	NVD
sonicwall 6bk1602-0aa32-0tp0_firmware sonicwall:6bk1602-0aa32-0tp0_firmware	before 2.7.0	NVD
1–10 of 60

References

References

https://logging.apache.org/log4j/2.x/security.html	x-refsource-misc, release-notes, vendor-advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032	x-refsource-confirm, third-party-advisory
https://www.kb.cert.org/vuls/id/930724	third-party-advisory, x-refsource-cert-vn, us-government-resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbd	vendor-advisory, x-refsource-cisco, third-party-advisory
http://www.openwall.com/lists/oss-security/2021/12/19/1	mailing-list, x-refsource-mlist, mitigation, third-party-advisory
https://www.debian.org/security/2021/dsa-5024	vendor-advisory, x-refsource-debian, third-party-advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf	x-refsource-confirm, third-party-advisory
https://security.netapp.com/advisory/ntap-20211218-0001/	x-refsource-confirm, third-party-advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-1541/	x-refsource-misc, third-party-advisory, vdb-entry
https://cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf	x-refsource-confirm, third-party-advisory
1–10 of 13

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.