What is CVE-2021-45105?

CVE-2021-45105 is a medium-severity vulnerability in Apache Log4j, classified under Improper Input Validation. CVSS score: 5.9/10. Published 2021-12-18.

How severe is CVE-2021-45105?

Medium severity. CVSS v3 base score is 5.9 out of 10.

Is CVE-2021-45105 known to be exploited?

149 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Log4Shell — Apache Log4j Improper input validation

CVE-2021-45105

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

Published 2021-12-18 · last modified 2026-08-25.

CVSS v3 metric

CVSS v3 base score 5.9 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H.

EPSS exploit prediction

EPSS: 1.000 (100.0th percentile), scored 2026-08-18.

Very high probability of exploitation in the next 30 days — among the top 0.1% most-likely-to-be-exploited CVEs. 100th percentile — 100.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

The 30-day trend appears once there are two daily scores.

Affected products

Apache Log4j
Apache Software Foundation Log4j2 — versions log4j-core
NetApp Cloud Manager
Oracle Agile Engineering Data Management — versions 6.2.1.0
Oracle Agile Plm — versions 9.3.6
Oracle Agile Plm Mcad Connector — versions 3.6
Oracle Agile Product Lifecycle Management — versions 9.3.6
Oracle Autovue For Agile Product Lifecycle Management — versions 21.0.2
Oracle Banking Deposits And Lines Of Credit Servicing — versions 2.12.0
Oracle Banking Enterprise Default Management — versions 2.7.1, 2.12.0

Weakness classification (CWE)

Public proof-of-concept exploits

References

logging.apache.org/log4j/2.x/security.html (Release Notes, Vendor Advisory)
psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 (Third Party Advisory)
www.kb.cert.org/vuls/id/930724 (US Government Resource, Third Party Advisory, third-party-advisory)
tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-apache-l… (vendor-advisory, Third Party Advisory)
www.openwall.com/lists/oss-security/2021/12/19/1 (mailing-list, Mailing List, Third Party Advisory, Mitigation)
www.debian.org/security/2021/dsa-5024 (vendor-advisory, Third Party Advisory)
cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf (Third Party Advisory)
security.netapp.com/advisory/ntap-20211218-0001/ (Third Party Advisory)
www.zerodayinitiative.com/advisories/ZDI-21-1541/ (VDB Entry, Third Party Advisory)
cert-portal.siemens.com/productcert/pdf/ssa-501673.pdf (Third Party Advisory)

Frequently asked questions

What is CVE-2021-45105?: CVE-2021-45105 is a medium-severity vulnerability in Apache Log4j, classified under Improper Input Validation. CVSS score: 5.9/10. Published 2021-12-18.
How severe is CVE-2021-45105?: Medium severity. CVSS v3 base score is 5.9 out of 10.
Is CVE-2021-45105 known to be exploited?: 149 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.