Log4j remote code injection
This is a supply-chain lesson in treating logging paths as executable trust boundaries when a framework adds interpretation features. The useful defensive question is not whether an application calls a risky API directly, but whether any attacker-influenced…
- Original severity
- critical; CVSS 10.0 source-reported; not rescored by vulns.co
- Public source
- github advisory
- Program / vendor
- Apache
- Product / surface
- Apache Log4j logging library
- Weakness
- Injection through untrusted log data reaching a lookup-capable component · CWE-20, CWE-400, CWE-502, CWE-917
- Affected boundary
- data-to-code boundary
- Disclosure date
- 2021-12-10
- Public status checked
- 2026-09-10
- Public attribution
- ppkarwasz (credit listed by the source)
What the evidence established
The public advisory establishes that attacker-controlled data could cross from logging input into a component with code-execution consequences.
Why the impact was credible
The source rates the issue Critical with CVSS 10.0; affected deployments required urgent upgrade and exposure review.
Durable engineering lesson
This is a supply-chain lesson in treating logging paths as executable trust boundaries when a framework adds interpretation features. The useful defensive question is not whether an application calls a risky API directly, but whether any attacker-influenced value can reach the affected library through normal observability paths. This record deliberately links to the public advisory instead of reproducing exploit material.
Control pattern
Upgrade to a fixed release, remove vulnerable lookup behavior, and inventory transitive dependencies rather than assuming direct use is the only exposure.
Primary public disclosure
Upstream availability and wording can change. Public status was last checked 2026-09-10.