CVE-2021-45105

CVE-2021-45105: Apache Log4j2 does not always protect from infinite recursion in lookup evaluation

Vendor Apache Software Foundation

Product Apache Log4j2

Weakness CWE-20 · Input validation

Published December 18, 2021

Last update May 29, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

Key dates

02Disclosure timeline

December 18, 2021 CVE published

May 29, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2021-45105 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/20.html AskarLabs — CWE-20 write-up Improper Input Validation

Related vulnerabilities

04Related CVE

CVE-2024-5533 Divi <= 4.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-7507 elink – Embed Content <= 1.1.0 - Authenticated (Contributor+) Insufficient Input Validation CVE-2024-2650 Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2026-1782 MetForm Pro <= 3.9.7 - Unauthenticated Payment Amount Manipulation via 'mf-calculation' CVE-2024-2513 WP Chat App <= 3.6.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Image Attribute