Critical severityCISA KEVNVD Advisory· Published Dec 10, 2021· Updated Oct 21, 2025
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
CVE-2021-44228
Description
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.logging.log4j:log4j-coreMaven | >= 2.13.0, < 2.15.0 | 2.15.0 |
org.apache.logging.log4j:log4j-coreMaven | >= 2.0-beta9, < 2.3.1 | 2.3.1 |
org.apache.logging.log4j:log4j-coreMaven | >= 2.4, < 2.12.2 | 2.12.2 |
com.guicedee.services:log4j-coreMaven | <= 1.2.1.2-jre17 | — |
org.ops4j.pax.logging:pax-logging-log4j2Maven | >= 1.8.0, < 1.9.2 | 1.9.2 |
org.ops4j.pax.logging:pax-logging-log4j2Maven | >= 1.10.0, < 1.10.8 | 1.10.8 |
org.ops4j.pax.logging:pax-logging-log4j2Maven | >= 1.11.0, < 1.11.10 | 1.11.10 |
org.ops4j.pax.logging:pax-logging-log4j2Maven | >= 2.0.0, < 2.0.11 | 2.0.11 |
Affected products
23- ghsa-coords22 versionspkg:maven/com.guicedee.services/log4j-corepkg:maven/org.apache.logging.log4j/log4j-corepkg:maven/org.ops4j.pax.logging/pax-logging-log4j2pkg:maven/org.xbib.elasticsearch/log4jpkg:maven/uk.co.nichesolutions.logging.log4j/log4j-corepkg:rpm/opensuse/disruptor&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/disruptor&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/jakarta-servlet&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/jakarta-servlet&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/log4j&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/log4j&distro=openSUSE%20Leap%2015.3pkg:rpm/opensuse/log4j&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/logback&distro=openSUSE%20Leap%2015.2pkg:rpm/opensuse/logback&distro=openSUSE%20Leap%2015.3pkg:rpm/suse/storm&distro=HPE%20Helion%20OpenStack%208pkg:rpm/suse/storm&distro=SUSE%20OpenStack%20Cloud%208pkg:rpm/suse/storm&distro=SUSE%20OpenStack%20Cloud%209pkg:rpm/suse/storm&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208pkg:rpm/suse/storm&distro=SUSE%20OpenStack%20Cloud%20Crowbar%209pkg:rpm/suse/venv-openstack-monasca&distro=HPE%20Helion%20OpenStack%208pkg:rpm/suse/venv-openstack-monasca&distro=SUSE%20OpenStack%20Cloud%208pkg:rpm/suse/venv-openstack-monasca&distro=SUSE%20OpenStack%20Cloud%209
<= 1.2.1.2-jre17+ 21 more
- (no CPE)range: <= 1.2.1.2-jre17
- (no CPE)range: >= 2.13.0, < 2.15.0
- (no CPE)range: >= 1.8.0, < 1.9.2
- (no CPE)
- (no CPE)
- (no CPE)range: < 3.4.4-lp152.2.3.1
- (no CPE)range: < 3.4.4-3.3.1
- (no CPE)range: < 5.0.0-lp152.2.1
- (no CPE)range: < 5.0.0-5.3.1
- (no CPE)range: < 2.13.0-lp152.3.3.1
- (no CPE)range: < 2.13.0-4.3.1
- (no CPE)range: < 2.13.2-2.1
- (no CPE)range: < 1.2.8-lp152.2.3.2
- (no CPE)range: < 1.2.8-3.3.1
- (no CPE)range: < 1.2.3-3.8.2
- (no CPE)range: < 1.2.3-3.8.2
- (no CPE)range: < 1.2.3-3.5.1
- (no CPE)range: < 1.2.3-3.8.2
- (no CPE)range: < 1.2.3-3.5.1
- (no CPE)range: < 2.2.2~dev1-11.32.1
- (no CPE)range: < 2.2.2~dev1-11.32.1
- (no CPE)range: < 2.7.1~dev10-3.25.1
- Apache Software Foundation/Apache Log4j2v5Range: 2.0-beta9
Patches
Vulnerability mechanics
References
77- github.com/advisories/GHSA-7rjr-3q55-vv33ghsaADVISORY
- github.com/advisories/GHSA-jfh8-c2jp-5v3qghsaADVISORY
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIB/mitrevendor-advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/mitrevendor-advisory
- msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/mitrevendor-advisory
- nvd.nist.gov/vuln/detail/CVE-2021-44228ghsaADVISORY
- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbdghsavendor-advisoryWEB
- www.debian.org/security/2021/dsa-5020ghsavendor-advisoryWEB
- www.kb.cert.org/vuls/id/930724ghsathird-party-advisoryWEB
- packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.htmlghsaWEB
- packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.htmlghsaWEB
- packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.htmlghsaWEB
- packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.htmlghsaWEB
- packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.htmlghsaWEB
- packetstormsecurity.com/files/165282/Log4j-Payload-Generator.htmlghsaWEB
- packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.htmlghsaWEB
- packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.htmlghsaWEB
- packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.htmlghsaWEB
- packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.htmlghsaWEB
- packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.htmlghsaWEB
- packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.htmlghsaWEB
- packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.htmlghsaWEB
- packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.htmlghsaWEB
- packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.htmlghsaWEB
- packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.htmlghsaWEB
- seclists.org/fulldisclosure/2022/Dec/2ghsamailing-listWEB
- seclists.org/fulldisclosure/2022/Jul/11ghsamailing-listWEB
- seclists.org/fulldisclosure/2022/Mar/23ghsamailing-listWEB
- www.openwall.com/lists/oss-security/2021/12/10/1ghsamailing-listWEB
- www.openwall.com/lists/oss-security/2021/12/10/2ghsamailing-listWEB
- www.openwall.com/lists/oss-security/2021/12/10/3ghsamailing-listWEB
- www.openwall.com/lists/oss-security/2021/12/13/1ghsamailing-listWEB
- www.openwall.com/lists/oss-security/2021/12/13/2ghsamailing-listWEB
- www.openwall.com/lists/oss-security/2021/12/14/4ghsamailing-listWEB
- www.openwall.com/lists/oss-security/2021/12/15/3ghsamailing-listWEB
- cert-portal.siemens.com/productcert/pdf/ssa-397453.pdfghsaWEB
- cert-portal.siemens.com/productcert/pdf/ssa-479842.pdfghsaWEB
- cert-portal.siemens.com/productcert/pdf/ssa-661247.pdfghsaWEB
- cert-portal.siemens.com/productcert/pdf/ssa-714170.pdfghsaWEB
- github.com/apache/logging-log4j2/pull/608ghsaWEB
- github.com/cisagov/log4j-affected-db/blob/develop/SOFTWARE-LIST.mdghsaWEB
- github.com/github/advisory-database/pull/5501ghsaWEB
- github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-44228ghsaWEB
- issues.apache.org/jira/browse/LOG4J2-3198ghsaWEB
- issues.apache.org/jira/browse/LOG4J2-3201ghsaWEB
- issues.apache.org/jira/browse/LOG4J2-3214ghsaWEB
- issues.apache.org/jira/browse/LOG4J2-3221ghsaWEB
- lists.debian.org/debian-lts-announce/2021/12/msg00007.htmlghsamailing-listWEB
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIBghsaWEB
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFMghsaWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M5CSVUNV4HWZZXGOKNSK6L7RPM7BOKIBghsaWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFMghsaWEB
- logging.apache.org/log4j/2.x/changes-report.htmlghsaWEB
- logging.apache.org/log4j/2.x/manual/lookups.htmlghsaWEB
- logging.apache.org/log4j/2.x/manual/migration.htmlghsaWEB
- logging.apache.org/log4j/2.x/security.htmlghsaWEB
- msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2ghsaWEB
- packetstormsecurity.com/files/165673/UniFi-Network-Application-Unauthenticated-Log4Shell-Remote-Code-Execution.htmlghsaWEB
- packetstormsecurity.com/files/167794/Open-Xchange-App-Suite-7.10.x-Cross-Site-Scripting-Command-Injection.htmlghsaWEB
- packetstormsecurity.com/files/167917/MobileIron-Log4Shell-Remote-Command-Execution.htmlghsaWEB
- packetstormsecurity.com/files/171626/AD-Manager-Plus-7122-Remote-Code-Execution.htmlghsaWEB
- psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032ghsaWEB
- sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-log4j-qRuKNEbdghsaWEB
- seclists.org/fulldisclosure/2022/Dec/2ghsaWEB
- seclists.org/fulldisclosure/2022/Jul/11ghsaWEB
- seclists.org/fulldisclosure/2022/Mar/23ghsaWEB
- security.netapp.com/advisory/ntap-20211210-0007ghsaWEB
- support.apple.com/kb/HT213189ghsaWEB
- twitter.com/kurtseifried/status/1469345530182455296ghsaWEB
- www.bentley.com/en/common-vulnerability-exposure/be-2022-0001ghsaWEB
- www.cisa.gov/known-exploited-vulnerabilities-catalogghsaWEB
- www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00646.htmlghsaWEB
- www.nu11secur1ty.com/2021/12/cve-2021-44228.htmlghsaWEB
- www.oracle.com/security-alerts/alert-cve-2021-44228.htmlghsaWEB
- www.oracle.com/security-alerts/cpuapr2022.htmlghsaWEB
- www.oracle.com/security-alerts/cpujan2022.htmlghsaWEB
- security.netapp.com/advisory/ntap-20211210-0007/mitre
News mentions
3- What do Ports Hear When Nobody's Listening? An Assessment of Automated Cybercrime [Guest Diary], (Wed, Jun 24th)SANS Internet Storm Center · Jun 25, 2026
- Inside the customer environment: Where threat actors, vulnerabilities, and exposed assets intersectTenable Blog · May 27, 2026
- From Stuxnet to ChatGPT: 20 News Events That Shaped CyberDark Reading · May 6, 2026