Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer

CVE-2017-5645

critical

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially…

Vendor / product: Apache — log4j

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

CVSS
9.8
9.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2017-04-17 21:59
Modified: 2026-10-08 22:16
NVD status: Modified
Last synced 2 days ago
Verified against the source API 2026-10-27 07:06 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

apache / log4j ≥2.0 <2.8.2
netapp / oncommand_api_services all versions
netapp / oncommand_insight all versions
netapp / oncommand_workflow_automation all versions
netapp / service_level_manager all versions
netapp / snapcenter all versions
netapp / storage_automation_store all versions
redhat / fuse 1.0
redhat / enterprise_linux 6.0, 6.7, 7.0, 7.3, 7.4, 7.5
redhat / enterprise_linux_desktop 7.0
redhat / enterprise_linux_server 7.0
redhat / enterprise_linux_server_aus 7.4, 7.6
redhat / enterprise_linux_server_eus 7.4, 7.5, 7.6
redhat / enterprise_linux_server_tus 7.4, 7.6
redhat / enterprise_linux_workstation 7.0
oracle / api_gateway 11.1.2.4.0
oracle / application_testing_suite 13.3.0.1
oracle / autovue_vuelink_integration 21.0.0, 21.0.1
oracle / banking_platform 2.6.0, 2.6.1, 2.6.2
oracle / bi_publisher 11.1.1.7.0, 11.1.1.9.0, 12.2.1.3.0, 12.2.1.4.0
oracle / communications_converged_application_server_-_service_controller 6.1
oracle / communications_instant_messaging_server 10.0.1.3.0
oracle / communications_interactive_session_recorder ≥6.0 ≤6.2
oracle / communications_messaging_server <8.0.2
oracle / communications_network_integrity ≥7.3.2 ≤7.3.6
oracle / communications_online_mediation_controller 6.1
oracle / communications_pricing_design_center 11.1, 12.0
oracle / communications_service_broker 6.0
oracle / communications_webrtc_session_controller <7.2
oracle / configuration_manager 12.1.2.0.2, 12.1.2.0.5
oracle / endeca_information_discovery_studio 3.2.0
oracle / enterprise_data_quality 12.2.1.3.0
oracle / enterprise_manager_base_platform 12.1.0.5, 13.2.0.0
oracle / enterprise_manager_for_fusion_middleware 12.1.0.5, 13.2.0.0
oracle / enterprise_manager_for_mysql_database ≤13.2.2.0.0
oracle / enterprise_manager_for_oracle_database 12.1.0.8, 13.2.2
oracle / enterprise_manager_for_peoplesoft 13.1.1.1, 13.2.1.1
oracle / financial_services_analytical_applications_infrastructure ≥7.3.3.0.0 ≤7.3.3.0.2, ≥8.0.0.0.0 ≤8.0.7.0.0
oracle / financial_services_behavior_detection_platform ≥8.0.0.0.0 ≤8.0.4.0.0, 6.1.1
oracle / financial_services_hedge_management_and_ifrs_valuations 8.0.4, 8.0.5
oracle / financial_services_lending_and_leasing ≥14.1.0 ≤14.8.0, 12.5.0
oracle / financial_services_loan_loss_forecasting_and_provisioning 8.0.4, 8.0.5
oracle / financial_services_profitability_management ≥8.0.0.0.0 ≤8.0.7.0.0, 6.1.1
oracle / financial_services_regulatory_reporting_with_agilereporter 8.0.9.2.0
oracle / flexcube_investor_servicing 12.0.4, 12.1.0, 12.3.0, 12.4.0, 14.0.0
oracle / fusion_middleware_mapviewer 12.2.1.2, 12.2.1.3
oracle / goldengate 12.3.2.1.1
oracle / goldengate_application_adapters 12.3.2.1.1
oracle / identity_analytics 11.1.1.5.8
oracle / identity_management_suite 11.1.2.3.0, 12.2.1.3.0

Weakness classification (CWE)

CWE-502

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://issues.apache.org/jira/browse/LOG4J2-1863
Vendor advisory: https://issues.apache.org/jira/browse/LOG4J2-1863
Patch / mitigation: http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
Patch / mitigation: http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
Patch / mitigation: http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
Patch / mitigation: http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
Patch / mitigation: https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
Patch / mitigation: https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html
Patch / mitigation: https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html
Patch / mitigation: https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
Patch / mitigation: http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
Patch / mitigation: http://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html

References

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 07:06 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

Related CVEs

CVE-2023-31101CVE-2026-111497CVE-2026-95664CVE-2026-34197CVE-2026-34486