CVE-2021-44832

Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.

View graph Watch Export

CVSS v3.1

6.6 MEDIUM

EPSS

97.9%

probability of exploitation in 30 days

CISA KEV

Not listed

no confirmed exploitation reported

News coverage

sources referencing this CVE

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityHIGH

Privileges RequiredHIGH

User InteractionNONE

ScopeUNCHANGED

ConfidentialityHIGH

IntegrityHIGH

AvailabilityHIGH

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Timeline

disclosure → media coverage

Dec 28, 2021

Disclosure — published as a CVE record. · last revised by NVD May 29, 2026

Public PoC (2)

github.com/cckuailong/log4j_RCE_CVE-2021-44832 github.com/name/log4j-scanner

Unverified third-party code — review before executing.