CVE-2020-9488: Improper validation of certificate with host mismatch in Apache Log4j SMTP appender
Summary
CVE-2020-9488: Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. Affects org.apache.logging.log4j:log4j across 3 version ranges.
< 2.3.2
>= 2.4.0, < 2.12.3
>= 2.13.0, < 2.13.2
Fixed in 2.3.2, 2.12.3 or 2.13.2, depending on the release line you run. How to fix ↓
Also tracked for
- apache-log4j2 · Debian:11
The same CVE-2020-9488 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Log4j is a Java-based logging utility that provides a flexible and powerful framework for logging application messages. It is widely used in various software projects and provides features such as log levels, loggers, appenders, and layouts. The Log4j SMTP appender allows log messages to be sent via email using the Simple Mail Transfer Protocol (SMTP). This vulnerability affects versions of Log4j prior to 2.13.2.
Vulnerability Detail
The vulnerability in Apache Log4j SMTP appender is due to improper validation of certificates with host mismatches. When establishing an SMTPS connection, Log4j does not properly verify if the certificate presented by the server matches the expected host. This flaw can be exploited by a man-in-the-middle attacker to intercept the SMTPS connection and potentially leak any log messages sent through that appender. This could lead to the exposure of sensitive information or the manipulation of log data.
How To Fix
Latest published version: 3.0.0-beta3 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.3.22.3.2 -
>= 2.4.0, < 2.12.32.12.3 -
>= 2.13.0, < 2.13.22.13.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by disabling the SMTPS appender or switching to a different logging mechanism that does not rely on Log4j SMTP appender. However, this should be considered a temporary solution, and upgrading to the patched version is strongly recommended.
Conclusion
The vulnerability in Apache Log4j SMTP appender can be mitigated by upgrading to version 2.13.2 or later. It is important to promptly apply the patch to ensure the proper validation of certificates and prevent potential interception of SMTPS connections. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.logging.log4j:log4j →
FAQ
Apache Log4j is a Java-based logging utility used in various software projects to log application messages.
The Log4j SMTP appender is a component that allows log messages to be sent via email using the Simple Mail Transfer Protocol (SMTP).
This vulnerability could allow a man-in-the-middle attacker to intercept SMTPS connections and potentially leak log messages, leading to the exposure of sensitive information or the manipulation of log data.
To fix this vulnerability, it is recommended to upgrade to Apache Log4j version 2.13.2 or later.
A temporary workaround is to disable the SMTPS appender or switch to a different logging mechanism that does not rely on Log4j SMTP appender.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.logging.log4j:log4j.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
