CVE-2021-45105

Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

MEDIUM 5.9EPSS 100.0%

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

Affected: Apache Software Foundation · Apache Log4j2
CVSS v3.1 NVD: 5.9 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v3.1 GitHub: 8.6 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CVSS v2.0 NVD: 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P
EPSS: 100.00% chance of exploitation in the next 30 days, 100th percentile
Published: 2021-12-18
Updated: 2026-05-29

Proof-of-concept exploits (10)

Locj41/demo-cve2021-451050★ · 2024-01-02
Puliczek/CVE-2021-44228-PoC-log4j-bypass-words950★ · 2022-01-15
asksven/log4j-poc1★ · 2021-12-20
cckuailong/Log4j_dos_CVE-2021-4510513★ · 2021-12-19
dileepdkumar/https-github.com-pravin-pp-log4j2-CVE-2021-45105-10★ · 2021-12-23
evmcoedevsecops/log4j2_Demo0★ · 2022-04-20
iAmSOScArEd/log4j2_dos_exploit3★ · 2021-12-22
pravin-pp/log4j2-CVE-2021-451050★ · 2021-12-18
sschakraborty/SecurityPOC1★ · 2023-03-07
tejas-nagchandi/CVE-2021-451050★ · 2021-12-20

CVE-2021-45105

Proof-of-concept exploits (10)

Security advisories

References

Related