CVE-2017-5645
CriticalCVSS 9.8Exploitation Probability (EPSS)
Very high risk100th percentile - higher than 100% of all known CVEs
Summary
In Apache Log4j 2.x before version 2.8.2, when using the TCP socket server or UDP socket server to receive log events, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
Risk Assessment
An attacker can exploit this vulnerability to execute arbitrary code remotely, posing a serious threat to the security of the application and the organization's data.
Recommendation
It is recommended to upgrade Apache Log4j to version 2.8.2 or later to mitigate this vulnerability.
Other vulnerabilities in Apache Log4j
See all- CVE-2021-45046CriticalActively exploited
The fix for CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. Attackers with control over Thread Context Map (MDC) input data when using a non-default Pattern Layout with Context Lookup (e.g., $${ctx:loginId}) or Thread Context Map pattern (%X, %mdc, %MDC) can craft malicious input using a JNDI Lookup pattern, leading to information leak and remote code execution in some environments and local code execution in all environments.
- CVE-2026-34481High
Apache Log4j JsonTemplateLayout up to version 2.25.3 produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, -Infinity), which violates RFC 8259. An attacker can exploit this if the application uses JsonTemplateLayout and logs a MapMessage or an object with a controlled floating-point value.
Original NVD description (English source)
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS