CVE-2021-45105: Apache LOG4J
Medium severity, CVSS 5.9. EPSS: 100% chance of exploitation in the next 30 days.
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
Affected products
- Apache LOG4J: from 2.0, before 2.3.1 (fixed in 2.3.1); from 2.4, before 2.12.3 (fixed in 2.12.3); from 2.13.0, up to and including 2.16.0
- Debian Debian Linux: version 10.0 only; version 11.0 only
- Netapp Cloud Manager: affected versions not specified
- Oracle Agile Engineering Data Management: version 6.2.1.0 only
- Oracle Agile PLM Mcad Connector: version 3.6 only
- Oracle Agile Product Lifecycle Management: version 9.3.6 only
- Oracle Autovue For Agile Product Lifecycle Management: version 21.0.2 only
- Oracle Banking Deposits And Lines Of Credit Servicing: version 2.12.0 only
- Oracle Banking Enterprise Default Management: version 2.7.1 only; version 2.12.0 only
- Oracle Banking Loans Servicing: version 2.12.0 only
- Oracle Banking Party Management: version 2.7.0 only
- Oracle Banking Payments: version 14.5 only
- Oracle Banking Platform: version 2.6.2 only; version 2.7.1 only; version 2.12.0 only
- Oracle Banking Trade Finance: version 14.5 only
- Oracle Banking Treasury Management: version 14.5 only
- Oracle Business Intelligence: version 5.5.0.0.0 only
- Oracle Communications Asap: version 7.3 only
- Oracle Communications Billing And Revenue Management: version 12.0.0.4 only; version 12.0.0.5 only
- Oracle Communications Cloud Native Core Console: version 1.9.0 only
- Oracle Communications Cloud Native Core Network Function Cloud Native Environment: version 1.10.0 only
- Oracle Communications Cloud Native Core Network Repository Function: version 1.15.0 only; version 1.15.1 only
- Oracle Communications Cloud Native Core Network Slice Selection Function: version 1.8.0 only
- Oracle Communications Cloud Native Core Policy: version 1.15.0 only
- Oracle Communications Cloud Native Core Security Edge Protection Proxy: version 1.7.0 only
- Oracle Communications Cloud Native Core Service Communication Proxy: version 1.15.0 only
- and 91 more
Published 2021-12-18. Last modified 2026-08-25.