# CVE-2019-17571: Apache Log4j deserialization in SocketServer

Source: https://junglewise.ai/threats/cve-2019-17571-apache-log4j-deserialization-in-socketserver  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-01-06. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2019-17571 · Severity: critical · CVSS 9.8 · Published 2020-01-06

Apache Log4j 1.2 contains a component used for receiving log data over a network that is vulnerable to a critical security flaw. An attacker can exploit this to remotely take control of the server or execute unauthorized commands. This version of the software is end-of-life, and organizations are urged to migrate to a modern version of Log4j to protect their data and operations.

Technologies: [Apache Log4j](https://junglewise.ai/threats/technologies/log4j), [log4j:log4j (Maven)](https://junglewise.ai/threats/technologies/log4j-log4j), [org.zenframework.z8.dependencies.commons:log4j-1.2.17 (Maven)](https://junglewise.ai/threats/technologies/org-zenframework-z8-dependencies-commons-log4j-1-2-17). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2019-17571 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-17571 being exploited in the wild.

**How severe is CVE-2019-17571?** Critical severity, with a CVSS score of 9.8, published 6 January 2020.

**Which products and versions are affected?** Apache Log4j >= 1.2, <= 1.2.17; log4j:log4j (Maven) >= 1.2, <= 1.2.17, ECOSYSTEM:introduced=1.2,last_affected=1.2.17; org.zenframework.z8.dependencies.commons:log4j-1.2.17 (Maven) = 2.0.

**Is there a fix for CVE-2019-17571?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2019-17571 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2019-17571?** Check whether you run Apache Log4j, log4j:log4j (Maven) or org.zenframework.z8.dependencies.commons:log4j-1.2.17 (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The SocketServer class in Apache Log4j versions 1.2 through 1.2.17 is vulnerable to deserialization of untrusted data. When the SocketServer is configured to listen for log data on a network port, it fails to properly validate incoming serialized objects. A remote, unauthenticated attacker can send a specially crafted malicious payload that, when combined with a suitable deserialization gadget on the classpath, results in arbitrary code execution. No patch is available for the 1.2.x branch as it has reached end-of-life; users must migrate to log4j-core (Log4j 2.x).

## Affected products

- Apache Log4j >= 1.2, <= 1.2.17

## Identifiers

- CVE-2019-17571
- GHSA-2qrg-x229-3v8q

## Timeline

- 2020-01-06: advisory: GitHub Advisory published

## References

- [https://api.github.com/users/scothale](https://api.github.com/users/scothale)
- [https://github.com/scothale](https://github.com/scothale)
- [https://api.github.com/users/scothale/gists%7B/gist_id%7D](https://api.github.com/users/scothale/gists%7B/gist_id%7D)
- [https://api.github.com/users/scothale/repos](https://api.github.com/users/scothale/repos)
- [https://avatars.githubusercontent.com/u/111319770?v=4](https://avatars.githubusercontent.com/u/111319770?v=4)
- [https://api.github.com/users/scothale/events%7B/privacy%7D](https://api.github.com/users/scothale/events%7B/privacy%7D)

## Related threats

- [Apache Log4j 1.x (EOL) allows Denial of Service (DoS)](https://junglewise.ai/threats/cve-2023-26464-apache-log4j-1-x-eol-allows-denial-of-service-dos)
- [Deserialization of Untrusted Data in Log4j 1.x](https://junglewise.ai/threats/cve-2022-23302-deserialization-of-untrusted-data-in-log4j-1-x)
- [Apache Log4j SQL injection in JDBCAppender](https://junglewise.ai/threats/cve-2022-23305-apache-log4j-sql-injection-in-jdbcappender)
- [Deserialization of Untrusted Data in Apache Log4j](https://junglewise.ai/threats/cve-2022-23307-deserialization-of-untrusted-data-in-apache-log4j)
- [JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data](https://junglewise.ai/threats/cve-2021-4104-jmsappender-in-log4j-1-2-is-vulnerable-to-deserialization-of)