CVE-2021-45046

Confirmed PUBLISHED

Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

Apache Software Foundation · Apache Log4j

Exploited in the wild Used in malware PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

9.0 Critical

At a Glance

It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.

apache ransomware cisa malware nuclei_scanner java

CVE Published: Dec 14, 2021
Exploitation Reported: May 01, 2023
CVSS: 9.0 Critical
EPSS: —

Remote No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
Apache Software Foundation	Apache Log4j	Apache Log4j2 to < 2.16.0	Affected

CVE References

20211210 Vulnerabilities in Apache Log4j Library Affecting Cisco Products: December 2021 tools.cisco.com · Vendor Advisory https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory...
DSA-5022 debian.org · Vendor Advisory https://www.debian.org/security/2021/dsa-5022
FEDORA-2021-5c9d12a93e lists.fedoraproject.org · Vendor Advisory https://lists.fedoraproject.org/archives/list/package-announce%40list...
FEDORA-2021-abbe24e41c lists.fedoraproject.org · Vendor Advisory https://lists.fedoraproject.org/archives/list/package-announce%40list...
VU#930724 kb.cert.org · Third-Party Advisory https://www.kb.cert.org/vuls/id/930724

Show 16 more references

[oss-security] 20211214 CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2021/12/14/4
[oss-security] 20211215 Re: CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2021/12/15/3
[oss-security] 20211218 Re: CVE-2021-45046: Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2021/12/18/1
psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032 psirt.global.sonicwall.com · CVE Record https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2021-0032
oracle.com/security-alerts/alert-cve-2021-44228.html oracle.com · CVE Record https://www.oracle.com/security-alerts/alert-cve-2021-44228.html
cve.org/CVERecord cve.org · CVE Record https://www.cve.org/CVERecord?id=CVE-2021-44228
logging.apache.org/log4j/2.x/security.html logging.apache.org · CVE Record https://logging.apache.org/log4j/2.x/security.html
cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf cert-portal.siemens.com · CVE Record https://cert-portal.siemens.com/productcert/pdf/ssa-661247.pdf
intel.com/content/www/us/en/security-center/advisory/i... intel.com · CVE Record https://www.intel.com/content/www/us/en/security-center/advisory/inte...
cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf cert-portal.siemens.com · CVE Record https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdf
cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf cert-portal.siemens.com · CVE Record https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdf
cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf cert-portal.siemens.com · CVE Record https://cert-portal.siemens.com/productcert/pdf/ssa-479842.pdf
oracle.com/security-alerts/cpujan2022.html oracle.com · CVE Record https://www.oracle.com/security-alerts/cpujan2022.html
oracle.com/security-alerts/cpuapr2022.html oracle.com · CVE Record https://www.oracle.com/security-alerts/cpuapr2022.html
oracle.com/security-alerts/cpujul2022.html oracle.com · CVE Record https://www.oracle.com/security-alerts/cpujul2022.html
security.gentoo.org/glsa/202310-16 security.gentoo.org · CVE Record https://security.gentoo.org/glsa/202310-16

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2023-05-01 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45046.yaml	Apr 25, 2025

CVSS Scores

CVSS v3.1 9.0 Critical

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitation Status

Exploited in the wild

Recorded 2023-05-01 00:00:00 UTC · CISA

Used in malware

Recorded 2023-05-01 00:00:00 UTC · CISA

Proof of concept available

Recorded 2021-12-15 05:48:53 UTC · GitHub

Weaknesses (CWE)

CWE-917

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Scanner Integrations

Scanner	Reference	Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45046.yaml	Apr 25, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

BobTheShoplifter/CVE-2021-45046-Info

github · Created 2021-12-15 09:01:37 UTC · 4 stars

Oh no another one

cckuailong/Log4j_CVE-2021-45046

github · Created 2021-12-15 05:48:53 UTC · 20 stars

Log4j 2.15.0 Privilege Escalation -- CVE-2021-45046

Apache Log4j2 - Remote Code Injection

nuclei · Created Unknown

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2021-45046

{
  "cve_id": "CVE-2021-45046",
  "title": "Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulne...",
  "affected_vendor": "Apache Software Foundation",
  "affected_product": "Apache Log4j",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 9.0,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2021-45046

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API