CVE-2021-45046Used in ransomware
Apache Log4j2
Apache Log4j2 Deserialization of Untrusted Data Vulnerability
What it is
Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, where the Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations.
What to do
Apply updates per vendor instructions.
Vendor notices and references
Description and required action as published by CISA. Full record at NVD.
Other Apache entries on the list
- Struts Apache Struts Command Injection Vulnerability CVE-2016-3081 · Oct 8, 2026
- Tomcat Apache Tomcat Missing Encryption of Sensitive Data Vulnerability CVE-2026-34486 · Aug 4, 2026
- ActiveMQ Apache ActiveMQ Improper Input Validation Vulnerability CVE-2026-34197 · Apr 16, 2026
- HTTP Server Apache HTTP Server Improper Escaping of Output Vulnerability CVE-2024-38475 · May 1, 2025
- Tomcat Apache Tomcat Path Equivalence Vulnerability CVE-2025-24813 · Apr 1, 2025
- OFBiz Apache OFBiz Forced Browsing Vulnerability CVE-2024-45195 · Feb 4, 2025