An open index of dependabot pull requests across open source projects.

org.apache.logging.log4j:log4j-core

Ecosystem:
maven
Package URL:
pkg:maven/org.apache.logging.log4j:log4j-core
Total PRs:
1,110 Dependabot PRs
Latest PR:
4 days ago
Unique Repositories:
555 repositories
Unique Repos (30 days):
20 repositories
Security Advisories
Apache Log4j Core: log injection in `Rfc5424Layout` due to silent configuration incompatibility
GHSA-445c-vh5m-36rj CVE-2026-34478 MODERATE published about 2 months ago • updated 3 days ago
Apache Log4j Core's [`Rfc5424Layout`](https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout), in versions 2.21.0 through 2.25.3, i...
Apache Log4j does not verify the TLS hostname in its Socket Appender
GHSA-vc5p-v9hr-52mj CVE-2025-68161 MODERATE published 6 months ago • updated 5 days ago
The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even...
Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion
GHSA-p6xc-xr62-6r2g CVE-2021-45105 HIGH published over 4 years ago • updated 2 days ago
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3) did not protect from uncontrolled recursion from self-referential lookups. This...
Improper Input Validation and Injection in Apache Log4j2
GHSA-8489-44mv-ggj8 CVE-2021-44832 MODERATE published over 4 years ago • updated 2 days ago
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to an attack where an attacker wi...
Incomplete fix for Apache Log4j vulnerability
GHSA-7rjr-3q55-vv33 CVE-2021-45046 CRITICAL published over 4 years ago • updated 2 days ago
# Impact The fix to address [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) in Apache Log4j 2.15.0 was incomplete in certain non...
Recent PRs
Package Details
Name: org.apache.logging.log4j:log4j-core
Ecosystem: maven
PURL Type: maven
Package URL: pkg:maven/org.apache.logging.log4j:log4j-core
JSON API: View JSON
Security Advisories

10

Active advisories
CRITICAL 2
HIGH 2
MODERATE 5
LOW 1
View All maven Advisories
Package Information
Description:

The Apache Log4j Implementation

Repository: https://github.com/apache/logging-log4j2
Homepage: https://logging.apache.org/log4j/3.x/
Latest Release: 2.24.3
over 1 year ago
Dependent Repos: 82,953
Dependent Packages: 8,839
Ranking: Top 0.0126% by dependent repos Top 0.0068% by dependent pkgs
PR Status
Open 532 (47.9%)
Merged 214 (19.3%)
Closed 358 (32.3%)
PR Types
Major 1 (0.1%)
Minor 628 (56.6%)
Patch 446 (40.2%)