Product by Debian

Apache-log4j2

4 known vulnerabilities in Apache-log4j2 (Debian), 2 of them actively exploited (CISA KEV).

Vulnerabilities

Actively exploited (KEV)

Used by ransomware

Critical

Vulnerabilities

Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

Vulnerabilities in Apache-log4j2 (Debian)

Critical	CVE-2021-44228	Apache Log4j2 Remote Code Execution Vulnerability In CISA KEVRansomwarealso in 74 other products	10.0	10.12.2021
Critical	CVE-2021-45046	Apache Log4j2 Deserialization of Untrusted Data Vulnerability In CISA KEVRansomwarealso in 22 other products	9.0	14.12.2021
Medium	CVE-2021-45105	Apache Log4j2 does not always protect from infinite recursion in lookup evaluation also in 107 other products	5.9	18.12.2021
Medium	CVE-2025-68161	Apache Log4j Core: Missing TLS hostname verification in Socket appender also in 10 other products	4.8	18.12.2025

SSA-397453 V1.0: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to Siemens Energy TraceAlertServerPLUSsiemens-productcert
SSA-714170 V1.0: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to SPPA-T3000siemens-productcert
SSA-661247 V1.0: Apache Log4j Vulnerability (CVE-2021-44228, Log4Shell) - Impact to Siemens Productssiemens-productcert
SSA-479842 V1.0: Apache Log4j Vulnerabilities - Impact to Siemens Energy Sensformer (Platform, Basic and Advanced)siemens-productcert
SSA-501673 V1.0: Apache Log4j Denial of Service Vulnerability (CVE-2021-45105) - Impact to Siemens Productssiemens-productcert