maven

org.apache.logging.log4j:log4j-core

11 Total advisories

11 Vulnerabilities

0 Malware

Dependency scanning

Check whether org.apache.logging.log4j:log4j-core is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

Explore dependency scanning Explore AI SAST →

Vulnerabilities

MEDIUM 6.6

Maven

CVE-2021-44832

Improper Input Validation and Injection in Apache Log4j2

Jan 4, 2022

LOW 3.7

Maven

CVE-2020-9488

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender

Jun 5, 2020

HIGH 8.6

Maven

CVE-2021-45105

Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion

Dec 18, 2021

UNKNOWN

Maven

CVE-2026-34478

Apache Log4j Core: log injection in `Rfc5424Layout` due to silent configuration incompatibility

Apr 10, 2026

UNKNOWN

Maven

CVE-2026-34477

Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration

Apr 10, 2026

UNKNOWN

Maven

CVE-2026-34480

Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters

Apr 10, 2026

UNKNOWN

Maven

CVE-2025-68161

Apache Log4j does not verify the TLS hostname in its Socket Appender

Dec 18, 2025

CRITICAL 9.0

Maven KEV

CVE-2021-45046

Incomplete fix for Apache Log4j vulnerability

Dec 14, 2021

CRITICAL 10.0

Maven KEV

CVE-2021-44228

Remote code injection in Log4j

Dec 10, 2021

HIGH 7.5

Maven

CVE-2023-26464

Apache Log4j 1.x (EOL) allows Denial of Service (DoS)

Mar 10, 2023

CRITICAL 9.8

Maven

CVE-2017-5645

Deserialization of Untrusted Data in Log4j

Jan 6, 2020

Browse more Maven advisories

Learn What is SAST?

Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes