boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2017-5645

CVE-2017-5645CRITICAL
Apache Software Foundation Apache Log4j — In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another app…
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .8979   99.8     —
AFFECTED
  Product       Versions                                     Fixed
  Apache Log4j  All versions between 2.0-alpha1 and 2.8.1 –  —
TIMELINE
  Jan 29  Reserved by apache
  Apr 17  Published (CNA: apache)
  Oct 8   ENRICHED — CVE-2017-5645 (Apache Software Foundation Apache Log4j). Received CVSS 9.8 and CPE data from NVD.
CWE-502 · CNA: apache · CVSS v3.1 · 82 references · NVD status: Modified

Description

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
January 29, 2017ReservedReserved by apache
April 17, 2017PublishedPublished (CNA: apache)
October 8, 2026ENRICHEDENRICHED — CVE-2017-5645 (Apache Software Foundation Apache Log4j). Received CVSS 9.8 and CPE data from NVD.

Affected

Affected products and packages — 1 row
VendorProduct / PackageEcosystemVersion introducedFixed
Apache Software FoundationApache Log4j—All versions between 2.0-alpha1 and 2.8.1—

Weaknesses

CWE-502

References (82)

Related

Authoritative record: CVE-2017-5645 at cve.org

Vendors: apache

Weaknesses: CWE-502

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2017-5645 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.