Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
AV AC PR UI S C I A CVSS EPSS %ile KEV
N L N N C H H H 10.0 1.0000 100.0 YES
AFFECTED
Product Versions Fixed
Apache Log4j2 2.0-beta9 – 2.3.1
TIMELINE
Nov 26 Reserved by apache
Dec 10 Added to CISA KEV, remediation due 2021-12-24
Dec 10 Published (CNA: apache)
Aug 11 ENRICHED — CVE-2021-44228 (Apache Log4j2). Received CVSS 10.0 and CPE data from NVD.
Aug 11 EXPLOIT PUBLISHED — CVE-2021-44228 (Apache Log4j2). Public exploit reference added.
Description
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2021-44228 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
