CVE-2021-3100: Amazon LOG4JHOTPATCH

High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days.

The Apache Log4j hotpatch package before log4j-cve-2021-44228-hotpatch-1.1-13 didn’t mimic the permissions of the JVM being patched, allowing it to escalate privileges.

Affected products

• Amazon LOG4JHOTPATCH: before 1.1-13 (fixed in 1.1-13)

Published 2022-04-19. Last modified 2026-06-17.