8.8High

CVE-2022-23307A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.

Apache Software Foundation Apache Log4j 1.x Published: 2022-01-18 18:25 (4 years ago)

Description

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

Weakness (CWE): CWE-502

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
Apache Software Foundation	Apache Log4j 1.x	1.2.1 – < unspecified, unspecified – ≤ 2.0-alpha1

References and patches

CVSS score

8.8High

Source: CISA-ADP · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (chance of exploitation in 30 days)

54.41%

higher than 99% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: total

Timeline

ID reserved2022-01-17
Published2022-01-18 18:25
Reached IP-DB2026-10-24 23:37
Last updated2026-05-27 16:44

Assigned by (CNA): apache

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Apache Log4j

6.3Medium

CVE-2026-49844 4 months ago

Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()

Apache Software Foundation Apache Log4j API

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026…

6.3Medium

CVE-2026-34481 7 months ago

Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout

Apache Software Foundation Apache Log4j JSON Template Layout

Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infini…

6.9Medium

CVE-2026-34480 7 months ago

Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters

Apache Software Foundation Apache Log4j Core

Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets producing inv…

1.1%EPSS

6.9Medium

CVE-2026-34479 7 months ago

Apache Log4j 1 to Log4j 2 bridge: Silent log event loss in Log4j1XmlLayout due to unescaped XML 1.0 forbidden characters

Apache Software Foundation Apache Log4j 1 to Log4j 2 bridge

The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output. Conforming XML parsers are required to reject documents containing such characters with a fatal error, …

6.9Medium

CVE-2026-34478 7 months ago

Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility

Apache Software Foundation Apache Log4j Core

Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames of security-relevant configuration att…

6.3Medium

CVE-2026-34477 7 months ago

Apache Log4j Core: verifyHostName attribute silently ignored in TLS configuration, allowing hostname verification bypass

Apache Software Foundation Apache Log4j Core

The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j…