CVE-2021-45105
HIGH 8.6EPSS 100.0%
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
- CVSS v3.1
- 5.9 MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS v3.1
- 5.9 MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS v3.1
- 8.6 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H - CVSS v2.0
- 4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:N/A:P - EPSS
- 100.00% chance of exploitation in the next 30 days, 100th percentile
- Published
- 2021-12-18
- Updated
- 2026-05-29
Proof-of-concept exploits (10)
- Locj41/demo-cve2021-451050★ · 2024-01-02
- Puliczek/CVE-2021-44228-PoC-log4j-bypass-words949★ · 2022-01-15
- asksven/log4j-poc1★ · 2021-12-20
- cckuailong/Log4j_dos_CVE-2021-4510513★ · 2021-12-19
- dileepdkumar/https-github.com-pravin-pp-log4j2-CVE-2021-45105-10★ · 2021-12-23
- evmcoedevsecops/log4j2_Demo0★ · 2022-04-20
- iAmSOScArEd/log4j2_dos_exploit3★ · 2021-12-22
- pravin-pp/log4j2-CVE-2021-451050★ · 2021-12-18
- sschakraborty/SecurityPOC1★ · 2023-03-07
- tejas-nagchandi/CVE-2021-451050★ · 2021-12-20