Executive brief
Apache Log4j is a widely used logging library for Java applications. A security flaw exists where certain encrypted connections (TLS) fail to verify the identity of the server they are connecting to, even when configured to do so. This could allow a sophisticated attacker on the same network to intercept or modify log data being sent to remote servers, potentially exposing sensitive system information or operational logs.
Technical details
Apache Log4j Core contains a vulnerability (CWE-297) where the 'verifyHostName' attribute within the <Ssl> configuration element is silently ignored. This flaw affects SMTP, Socket, and Syslog appenders when TLS is configured via nested <Ssl> elements. A network-based attacker can perform a man-in-the-middle (MitM) attack if they can present a certificate issued by a trusted Certificate Authority. This issue is an incomplete fix for a previous vulnerability and does not affect the HTTP appender. Users should upgrade to version 2.25.4 to ensure hostname verification is correctly enforced.
Affected products
- Apache Log4j Core >= 2.12.0, < 2.25.4; >= 3.0.0-alpha1, <= 3.0.0-beta3
Timeline
- 2026-04-10: advisory: Original advisory published by GitHub and NVD
- 2026-04-14: other: Advisory reviewed and updated