Log4Shell: Critical Apache Log4j Vulnerability Disclosed (CVE-2021-44228)

What happened

On December 10, 2021, a critical vulnerability in Apache Log4j 2, tracked as CVE-2021-44228 and nicknamed Log4Shell, was publicly disclosed. Log4j is an extremely common Java logging library, so the flaw affected a vast range of applications and services. The same day, the US Cybersecurity and Infrastructure Security Agency added it to its Known Exploited Vulnerabilities catalog.

The technical facts

According to the CVE record maintained by Apache, the flaw is in Log4j 2's JNDI features used in configuration, log messages and parameters, which did not protect against attacker-controlled LDAP and other JNDI endpoints. An attacker who could control log messages or their parameters could cause the library to load and execute arbitrary code from a remote server when message-lookup substitution was enabled. The issue was assigned a CVSS 3.1 base score of 10.0, the maximum, reflecting network attack vector, low complexity, and no privileges or user interaction required.

Affected versions

The CVE record states that Log4j2 versions from 2.0-beta9 through 2.15.0, excluding the security releases 2.12.2, 2.12.3 and 2.3.1, are affected. The record also notes the vulnerability is specific to log4j-core and does not affect log4net, log4cxx or other Apache Logging Services projects. Because Log4j is bundled into countless applications and frameworks, identifying every affected system was itself a major challenge for defenders.

Remediation

From Log4j 2.15.0, the vulnerable behaviour was disabled by default, and from version 2.16.0, along with 2.12.2, 2.12.3 and 2.3.1, the message-lookup functionality was removed entirely. The Apache Logging Services team advised upgrading to a fixed release. Organisations were also advised to inventory their software for bundled Log4j, and CISA published guidance and an affected-software list to help defenders respond.

Why it mattered

Log4Shell became one of the most significant vulnerabilities of its era because of the combination of maximum severity, trivial exploitation, and the sheer ubiquity of Log4j across enterprise Java software. It triggered an industry-wide emergency response and remediation effort spanning weeks. The disclosure, credited in the CVE record to Chen Zhaojun of the Alibaba Cloud Security Team, is frequently cited as a defining example of software-supply-chain risk in widely used open-source dependencies.

Related on Skillo

See also: the OpenSSL 3.0.7 buffer-overflow advisory.

Sources

• CVE-2021-44228 record (CVE.org / Apache)
• Apache Log4j Security page (official)
• CISA Known Exploited Vulnerabilities Catalog

Published date reflects the original event date (2021-12-10). This article is original Skillo editorial written from the sources above; facts were verified in September 2026.