Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

Vulnerability

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) do not protect against uncontrolled recursion caused by self-referential lookups [1][3]. This vulnerability resides in the lookup evaluation mechanism and is triggered when a crafted string containing recursive lookup patterns is processed. The attack requires the attacker to have control over the Thread Context Map (MDC) data [2][4].

Exploitation

An attacker must be able to inject or control data in the Thread Context Map used by Log4j, for example via user-supplied input that is later logged with a pattern layout that includes context lookups [1][3]. Once the attacker provides a specially crafted string (e.g., a pattern that references itself), Log4j enters an infinite recursion during lookup resolution, causing a denial of service [4]. The attacker does not need authentication if they can control MDC input.

Impact

Successful exploitation results in a denial of service (DoS) condition, typically consuming excessive CPU or memory and potentially crashing the Java application using Log4j [1][3]. The vulnerability does not lead to remote code execution (RCE) or information disclosure beyond what is already accessible via logging [2]. The scope is limited to the affected application process.

Mitigation

All users should upgrade to Log4j 2.17.0 (Java 8), 2.12.3 (Java 7), or 2.3.1 (Java 6) to patch this vulnerability [1][3]. No other workarounds are published; the fix disables the recursive lookup feature [4]. Users with EOL versions should upgrade to supported releases. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.