In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
Metrics
Affected Vendors & Products
References
History
Thu, 08 Oct 2026 22:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Status: PUBLISHED
Assigner: apache
Published: 2017-04-17T21:00:00.000Z
Updated: 2026-10-08T21:14:06.089Z
Reserved: 2017-01-29T00:00:00.000Z
Link: CVE-2017-5645
Updated: 2024-08-05T15:11:47.391Z
Status : Modified
Published: 2017-04-17T21:59:00.373
Modified: 2026-10-08T22:16:40.790
Link: CVE-2017-5645