CVE catalog

CVE-2021-44228

apache-log4j1.2: CVE-2021-44228

Severity: Critical · CVSS 10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published: Dec 9, 2021, 11:00:00 PM UTC
Source: [NVD] · [CVE record]
Exploitation: CISA Known Exploited Vulnerabilities
EPSS: 100.00% · Oct 25, 2026

Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	apache-log4j2	sid	`2.26.1-1`	fixed
Debian	apache-log4j2	forky	`2.19.0-2`	fixed
Debian	apache-log4j2	trixie	`2.19.0-2`	fixed
Debian	apache-log4j2	bookworm	`2.19.0-2`	fixed
Debian	apache-log4j1.2	sid	`1.2.17-11`	not affected
Debian	apache-log4j1.2	forky	`1.2.17-11`	not affected
Debian	apache-log4j1.2	trixie	`1.2.17-11`	not affected
Debian	apache-log4j1.2	bookworm	`1.2.17-11`	not affected
Ubuntu	apache-log4j2	pro	`2.2-1`	vulnerable
Ubuntu	apache-log4j2	pro	`2.4-1`	vulnerable
Ubuntu	apache-log4j2	pro	`2.4-2`	vulnerable
Ubuntu	apache-log4j2	pro	`2.4-2ubuntu0.1~esm1`	fixed
Ubuntu	apache-log4j2	18.04	`2.8.2-1`	vulnerable
Ubuntu	apache-log4j2	18.04	`2.8.2-2`	vulnerable
Ubuntu	apache-log4j2	18.04	`2.10.0-1`	vulnerable
Ubuntu	apache-log4j2	18.04	`2.10.0-2`	vulnerable
Ubuntu	apache-log4j2	18.04	`2.10.0-2ubuntu0.1`	fixed
Ubuntu	apache-log4j2	20.04	`2.11.1-2`	vulnerable
Ubuntu	apache-log4j2	20.04	`2.11.2-1`	vulnerable
Ubuntu	apache-log4j2	20.04	`2.15.0-0.20.04.1`	fixed
Ubuntu	apache-log4j2	20.04	`2.11.1-2`	vulnerable
Ubuntu	apache-log4j2	20.04	`2.11.2-1`	vulnerable
Ubuntu	apache-log4j2	20.04	`2.15.0-0.20.04.1`	vulnerable
Ubuntu	apache-log4j2	20.04	`2.16.0-0.20.04.1`	fixed
Ubuntu	apache-log4j2	pro	`2.2-1`	vulnerable
Ubuntu	apache-log4j2	pro	`2.4-1`	vulnerable
Ubuntu	apache-log4j2	pro	`2.4-2`	vulnerable
Ubuntu	apache-log4j2	pro	`2.4-2ubuntu0.1~esm1`	fixed
Ubuntu	apache-log4j2	18.04	`2.8.2-1`	vulnerable
Ubuntu	apache-log4j2	18.04	`2.8.2-2`	vulnerable
Ubuntu	apache-log4j2	18.04	`2.10.0-1`	vulnerable
Ubuntu	apache-log4j2	18.04	`2.10.0-2`	vulnerable
Ubuntu	apache-log4j2	18.04	`2.10.0-2ubuntu0.1`	fixed
Ubuntu	apache-log4j2	20.04	`2.11.1-2`	vulnerable
Ubuntu	apache-log4j2	20.04	`2.11.2-1`	vulnerable
Ubuntu	apache-log4j2	20.04	`2.15.0-0.20.04.1`	fixed
Opensuse	logback	leap 15.3	`1.2.8-3.3.1`	fixed
Opensuse	logback	leap 15.2	`1.2.8-lp152.2.3.2`	fixed
Opensuse	log4j	leap 15.3	`2.13.0-4.3.1`	fixed
Opensuse	log4j	leap 15.2	`2.13.0-lp152.3.6.1`	fixed
Opensuse	disruptor	leap 15.3	`3.4.4-3.3.1`	fixed
Opensuse	jakarta-servlet	leap 15.3	`5.0.0-5.3.1`	fixed
Opensuse	log4j	leap 15.3	`2.16.0-4.10.1`	fixed
Opensuse	log4j	leap 15.2	`2.13.0-lp152.3.3.1`	fixed
Opensuse	disruptor	leap 15.2	`3.4.4-lp152.2.3.1`	fixed
Opensuse	jakarta-servlet	leap 15.2	`5.0.0-lp152.2.1`	fixed
Opensuse	log4j	leap 15.2	`2.16.0-lp152.3.9.1`	fixed
Opensuse	log4j	tumbleweed	`2.13.2-2.1`	fixed
Opensuse	log4j	leap 15.3	`2.13.0-4.6.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	apache-log4j2	source	sid	`2.15.0-1`	not yet assigned	Not reported	[1001478]
Debian	apache-log4j2	source	forky	`2.15.0-1`	not yet assigned	Not reported	[1001478]
Debian	apache-log4j2	source	trixie	`2.15.0-1`	not yet assigned	Not reported	[1001478]
Debian	apache-log4j2	source	bookworm	`2.15.0-1`	not yet assigned	Not reported	[1001478]
Debian	apache-log4j1.2	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	apache-log4j1.2	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	apache-log4j1.2	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	apache-log4j1.2	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Ubuntu	apache-log4j2	deb	pro	`2.4-2ubuntu0.1~esm1`	Not reported	USN-5192-2	Not reported
Ubuntu	apache-log4j2	deb	18.04	`2.10.0-2ubuntu0.1`	Not reported	USN-5192-1	Not reported
Ubuntu	apache-log4j2	deb	20.04	`2.15.0-0.20.04.1`	Not reported	USN-5192-1	Not reported
Ubuntu	apache-log4j2	deb	20.04	`2.16.0-0.20.04.1`	Not reported	USN-5197-1	Not reported
Ubuntu	apache-log4j2	deb	pro	`2.4-2ubuntu0.1~esm1`	Not reported	UBUNTU-CVE-2021-44228	Not reported
Ubuntu	apache-log4j2	deb	18.04	`2.10.0-2ubuntu0.1`	Not reported	UBUNTU-CVE-2021-44228	Not reported
Ubuntu	apache-log4j2	deb	20.04	`2.15.0-0.20.04.1`	Not reported	UBUNTU-CVE-2021-44228	Not reported
Opensuse	logback	rpm	leap 15.3	`1.2.8-3.3.1`	Not reported	OPENSUSE-SU-2021:4109-1	Not reported
Opensuse	logback	rpm	leap 15.2	`1.2.8-lp152.2.3.2`	Not reported	OPENSUSE-SU-2021:1613-1	Not reported
Opensuse	log4j	rpm	leap 15.3	`2.13.0-4.3.1`	Not reported	OPENSUSE-SU-2021:3999-1	Not reported
Opensuse	log4j	rpm	leap 15.2	`2.13.0-lp152.3.6.1`	Not reported	OPENSUSE-SU-2021:1586-1	Not reported
Opensuse	disruptor	rpm	leap 15.3	`3.4.4-3.3.1`	Not reported	OPENSUSE-SU-2021:4107-1	Not reported
Opensuse	jakarta-servlet	rpm	leap 15.3	`5.0.0-5.3.1`	Not reported	OPENSUSE-SU-2021:4107-1	Not reported
Opensuse	log4j	rpm	leap 15.3	`2.16.0-4.10.1`	Not reported	OPENSUSE-SU-2021:4107-1	Not reported
Opensuse	log4j	rpm	leap 15.2	`2.13.0-lp152.3.3.1`	Not reported	OPENSUSE-SU-2021:1577-1	Not reported
Opensuse	disruptor	rpm	leap 15.2	`3.4.4-lp152.2.3.1`	Not reported	OPENSUSE-SU-2021:1601-1	Not reported
Opensuse	jakarta-servlet	rpm	leap 15.2	`5.0.0-lp152.2.1`	Not reported	OPENSUSE-SU-2021:1601-1	Not reported
Opensuse	log4j	rpm	leap 15.2	`2.16.0-lp152.3.9.1`	Not reported	OPENSUSE-SU-2021:1601-1	Not reported
Opensuse	log4j	rpm	tumbleweed	`2.13.2-2.1`	Not reported	OPENSUSE-SU-2024:11666-1	Not reported
Opensuse	log4j	rpm	leap 15.3	`2.13.0-4.6.1`	Not reported	OPENSUSE-SU-2021:4094-1	Not reported

[Debian bug #1001478]

OpenFactory catalog packages

[openSUSE Tumbleweed]

[log4j-bom]Unknown
Source package: [log4j]
Details (1)
- 2.26.1-2.1 · noarch · tumbleweed
  Unknown · Fixed: 2.13.2-2.1
  Version impact unknown
  dsa · log4j · opensuse · tumbleweed
[log4j-javadoc]Unknown
Source package: [log4j]
Details (1)
- 2.26.1-2.1 · noarch · tumbleweed
  Unknown · Fixed: 2.13.2-2.1
  Version impact unknown
  dsa · log4j · opensuse · tumbleweed
[log4j-jcl]Unknown
Source package: [log4j]
Details (1)
- 2.26.1-2.1 · noarch · tumbleweed
  Unknown · Fixed: 2.13.2-2.1
  Version impact unknown
  dsa · log4j · opensuse · tumbleweed
[log4j-nosql]Unknown
Source package: [log4j]
Details (1)
- 2.26.1-2.1 · noarch · tumbleweed
  Unknown · Fixed: 2.13.2-2.1
  Version impact unknown
  dsa · log4j · opensuse · tumbleweed
[log4j-slf4j]Unknown
Source package: [log4j]
Details (1)
- 2.26.1-2.1 · noarch · tumbleweed
  Unknown · Fixed: 2.13.2-2.1
  Version impact unknown
  dsa · log4j · opensuse · tumbleweed
[log4j-taglib]Unknown
Source package: [log4j]
Details (1)
- 2.26.1-2.1 · noarch · tumbleweed
  Unknown · Fixed: 2.13.2-2.1
  Version impact unknown
  dsa · log4j · opensuse · tumbleweed
[log4j-web]Unknown
Source package: [log4j]
Details (1)
- 2.26.1-2.1 · noarch · tumbleweed
  Unknown · Fixed: 2.13.2-2.1
  Version impact unknown
  dsa · log4j · opensuse · tumbleweed
[log4j]Fixed
Source package: [log4j]
Details (1)
- 2.26.1-2.1 · noarch · tumbleweed
  Fixed · Fixed: 2.13.2-2.1
  dsa · log4j · opensuse · tumbleweed

[Debian 12 (Bookworm)]

[liblog4j1.2-java]Not affected
Source package: [apache-log4j1.2]
Details (2)
- 1.2.17-11 · all · bookworm
  Not affected
  dsa · apache-log4j1.2 · debian · bookworm
- 1.2.17-11 · all · bookworm
  Not affected
  dsa · apache-log4j1.2 · debian · bookworm
[liblog4j1.2-java-doc]Not affected
Source package: [apache-log4j1.2]
Details (2)
- 1.2.17-11 · all · bookworm
  Not affected
  dsa · apache-log4j1.2 · debian · bookworm
- 1.2.17-11 · all · bookworm
  Not affected
  dsa · apache-log4j1.2 · debian · bookworm
[liblog4j2-java]Fixed
Source package: [apache-log4j2]
Details (2)
- 2.19.0-2 · all · bookworm
  Fixed · Fixed: 2.15.0-1
  dsa · apache-log4j2 · debian · bookworm; dsa · apache-log4j2 · debian · 12
- 2.19.0-2 · all · bookworm
  Fixed · Fixed: 2.15.0-1
  dsa · apache-log4j2 · debian · bookworm; dsa · apache-log4j2 · debian · 12

[Debian 13 (Trixie)]

[liblog4j2-java]Fixed
Source package: [apache-log4j2]
Details (2)
- 2.19.0-2 · all · trixie
  Fixed · Fixed: 2.15.0-1
  dsa · apache-log4j2 · debian · 13
- 2.19.0-2 · all · trixie
  Fixed · Fixed: 2.15.0-1
  dsa · apache-log4j2 · debian · 13

Observed: Oct 23, 2026, 6:03:32 PM UTC

References

[CERT-Bund public advisories] · [CISA cybersecurity advisories] · [CISA Known Exploited Vulnerabilities (OSINT)] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]