CVE-2021-45105: Apache Log4j2 Improper Input Validation and Uncontrolled Recursion
Summary
CVE-2021-45105: Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion. Affects org.apache.logging.log4j:log4j-core across 3 version ranges.
< 2.3.1
>= 2.4.0, < 2.12.3
>= 2.13.0, < 2.17.0
Fixed in 2.3.1, 2.12.3 or 2.17.0, depending on the release line you run. How to fix ↓
Also tracked for
- apache-log4j2 · Debian:11
The same CVE-2021-45105 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Log4j2 is a popular logging framework for Java applications. It provides a flexible and efficient logging solution, allowing developers to log messages with different levels of severity and configure various appenders and layouts. Log4j2 consists of two main components: log4j-api and log4j-core. The log4j-api package provides the logging API, while the log4j-core package implements the logging functionality. This vulnerability affects the log4j-core package in versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3).
Vulnerability Detail
The vulnerability in Apache Log4j2 is related to improper input validation and uncontrolled recursion. Specifically, the framework did not protect against uncontrolled recursion from self-referential lookups in the Thread Context Map data. This means that an attacker who can control the data in the Thread Context Map can exploit this vulnerability to cause a denial of service (DoS) by providing a crafted string that triggers the recursion. The issue was addressed in Log4j versions 2.17.0 and 2.12.3.
How To Fix
Latest published version: 3.0.0-beta3 as of 22 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.3.12.3.1 -
>= 2.4.0, < 2.12.32.12.3 -
>= 2.13.0, < 2.17.02.17.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the patched versions of log4j-core.
Conclusion
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) are vulnerable to an improper input validation and uncontrolled recursion issue. This vulnerability can be exploited by an attacker to cause a denial of service. It is crucial to upgrade to the fixed versions (2.17.0 or 2.12.3) to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.logging.log4j:log4j-core →
FAQ
Apache Log4j2 is a logging framework for Java applications that provides a flexible and efficient logging solution.
The vulnerability affects Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3).
An attacker who can control the data in the Thread Context Map can exploit this vulnerability to cause a denial of service (DoS) by triggering uncontrolled recursion.
To fix this vulnerability, you should upgrade the log4j-core package to version 2.17.0 or 2.12.3.
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to the patched versions of log4j-core.
Related vulnerabilities
Recent vulnerabilities recorded for org.apache.logging.log4j:log4j-core.
