Apache

CVE-2021-45105: Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

Is it exploited?

Reported, not confirmed by CISA. VulnCheck KEV lists it as exploited in the wild. CISA has not added it to its Known Exploited Vulnerabilities catalog as of 29 Oct 2026.

VulnCheck KEV lists it since 22 Dec 2021. It cites 17 public reports, the first from 22 Dec 2021.

How likely is exploitation in the next 30 days?

100%

EPSS score, percentile 100 of all scored records. A probability estimated by FIRST, not a report of exploitation.

How severe?

5.9 Medium

CVSS v3.1 base score, from CISA's enrichment of the record

What should I do?

CISA has set no required action, because the vulnerability is not in KEV.

Advisories and patches (2)

Which versions are affected?

Affected

from log4j-core to before 2.17.0
from 2.13.0
from 2.4
from 2.0-alpha1

Unaffected from 2.12.3; from 2.3.1

Versions by product

Source: CISA KEV 2026.10.29, as of 29 Oct 2026; VulnCheck KEV, as of 30 Oct 2026; FIRST EPSS, as of 30 Oct 2026; CVE List, as of 30 Oct 2026. About the data.

Description

Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

Source: CVE List, as of 30 Oct 2026. About the data.

What to do

Advisories and patches

20211210 Vulnerabilities in Apache Log4j Library Affecting Cisco Products: December 2021 (Vendor advisory)
DSA-5024 (Vendor advisory)

Workaround (from the CVE record)

Implement one of the following mitigation techniques: * Java 8 (or later) users should upgrade to release 2.17.0. Alternatively, this can be mitigated in configuration: * In PatternLayout in the logging configuration, replace Context Lookups like `${ctx:loginId}` or `$${ctx:loginId}` with Thread Context Map patterns (%X, %mdc, or %MDC). * Otherwise, in the configuration, remove references to Context Lookups like `${ctx:loginId}` or `$${ctx:loginId}` where they originate from sources external to the application such as HTTP headers or user input.

This summary is based on the CVE record as of 30 Oct 2026. Check the vendor's advisory before you act: affected versions and fixes can change.

Affected products and versions

Versions by product, as listed in the CVE record (1 product)

Apache Software Foundation Apache Log4j2
Status	Versions
Affected	from log4j-core to before 2.17.0
Affected	from 2.13.0
Unaffected	from 2.12.3
Affected	from 2.4
Unaffected	from 2.3.1
Affected	from 2.0-alpha1

Versions the record lists as unaffected: 2.12.3, 2.3.1.

Source: CVE List, as of 30 Oct 2026. About the data.

Weakness

CWE-20, CWE-674

CWE-20: Improper Input Validation
CWE-674: Uncontrolled Recursion

CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record.

Timeline

Date	Event
18 Dec 2021	CVE record published
29 May 2026	CVE record last updated

References

1 more in the CVE record.

Known exploited Apache vulnerabilities

CVE-2016-3081: Apache Struts Command Injection Vulnerability (added 8 Oct 2026)
CVE-2026-34486: Apache Tomcat Missing Encryption of Sensitive Data Vulnerability (added 4 Aug 2026)
CVE-2026-34197: Apache ActiveMQ Improper Input Validation Vulnerability (added 16 Apr 2026)
CVE-2024-38475: Apache HTTP Server Improper Escaping of Output Vulnerability (added 1 May 2025)
CVE-2025-24813: Apache Tomcat Path Equivalence Vulnerability (added 1 Apr 2025)