Read the docs
TI-2023-11611 Aliases CVE-2023-26464GHSA-vp98-w2p3-mv35

Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender

Priority MEDIUM 43CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution, Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 7 fixed, 17 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502 and CWE-400.

Summary

** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested) hashmap or hashtable (depending on which logging component is in use) to be processed could exhaust the available memory in the virtual machine and achieve Denial of Service when the object is deserialized. This issue affects Apache Log4j before 2. Affected users are recommended to update to Log4j 2.x. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01905 79th percentileScored 2026-11-07
Fix Partial Apache Log4j (Apache Software Foundation): 2org.apache.logging.log4j:log4j-core (Maven): 2.0+1 more productRed Hat: 7 advisoriesRed Hat: 7 fixed, 17 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Log4j1.0.4 to before 22Patch availableCNA
—org.apache.logging.log4j:log4j-core (Maven)1.0.4 to before 2.02.0Patch availableGHSA-vp98-w2p3-mv35
—log4j:log4j (Maven)1.0.4 to before 2.02.0Patch availableGHSA-vp98-w2p3-mv35
  • Apache Log4j VendorApache Affected 1.0.4 to before 2 Fixed in 2 Patch available CNA
  • org.apache.logging.log4j:log4j-core (Maven) Vendor— Affected 1.0.4 to before 2.0 Fixed in 2.0 Patch available GHSA-vp98-w2p3-mv35
  • log4j:log4j (Maven) Vendor— Affected 1.0.4 to before 2.0 Fixed in 2.0 Patch available GHSA-vp98-w2p3-mv35

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*1.0.4 to before 2.0VulnerableApache
  • cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* Versions 1.0.4 to before 2.0 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Log4j (Apache Software Foundation) Fixed in 2
  • Fix · GHSA-vp98-w2p3-mv35 org.apache.logging.log4j:log4j-core (Maven) Fixed in 2.0 Advisory →
  • Fix · GHSA-vp98-w2p3-mv35 log4j:log4j (Maven) Fixed in 2.0 Advisory →

Red Hat 7 advisories

  • RHSA-2024:10207 Released 2024-11-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.11 Security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-apache-cxf-3.4.10-1.SP1_redhat_00001.1.el7eap, eap7-apache-cxf-rt-3.4.10-1.SP1_redhat_00001.1.el7eap, eap7-apache-cxf-services-3.4.10-1.SP1_redhat_00001.1.el7eap +44
  • RHSA-2024:10208 Released 2024-11-25 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.8 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-apache-cxf-3.1.16-3.SP1_redhat_00001.1.ep7.el7, eap7-apache-cxf-rt-3.1.16-3.SP1_redhat_00001.1.ep7.el7, eap7-apache-cxf-services-3.1.16-3.SP1_redhat_00001.1.ep7.el7 +14
  • RHSA-2023:5485 Released 2023-10-06 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 8
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-2.16.0-15.redhat_00049.1.el8eap, eap7-activemq-artemis-cli-2.16.0-15.redhat_00049.1.el8eap, eap7-activemq-artemis-commons-2.16.0-15.redhat_00049.1.el8eap +47
Show 4 more Red Hat advisories
  • RHSA-2023:5486 Released 2023-10-06 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 9
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-2.16.0-15.redhat_00049.1.el9eap, eap7-activemq-artemis-cli-2.16.0-15.redhat_00049.1.el9eap, eap7-activemq-artemis-commons-2.16.0-15.redhat_00049.1.el9eap +47
  • RHSA-2023:5484 Released 2023-10-05 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.13 security update on RHEL 7
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-2.16.0-15.redhat_00049.1.el7eap, eap7-activemq-artemis-cli-2.16.0-15.redhat_00049.1.el7eap, eap7-activemq-artemis-commons-2.16.0-15.redhat_00049.1.el7eap +47
  • RHSA-2023:5488 Released 2023-10-05 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.13 security update
    • Red Hat JBoss Enterprise Application Platform io.netty.netty-handler-4.1.94.Final-redhat-00001.jar, org.bouncycastle.bcprov-jdk18on-1.76.0.redhat-00001.jar, org.jboss.hal.hal-console-3.3.19.Final-redhat-00001-resources.jar +2
  • RHSA-2023:3663 Released 2023-06-19 · Red Hat rating Important
    jenkins and jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8 jenkins-2-plugins-4.11.1686831822-1.el8, jenkins-2.401.1.1686831596-3.el8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for Applications 6AffectedNo fix planned: Will not fix
Migration Toolkit for RuntimesAffectedNo fix planned: Will not fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
Red Hat Data Grid 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat JBoss Data Grid 7AffectedNo fix planned: Will not fix
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Will not fix
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Web Server 3AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Will not fix
Red Hat OpenShift Dev SpacesAffectedNo fix yet
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Red Hat support for Spring BootAffectedNo fix yet
streams for Apache KafkaAffectedNo fix planned: Will not fix
OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8Fixed RHSA-2023:3663
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2023:5484
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2023:5485
Red Hat JBoss EAP 7.4 for RHEL 9Fixed RHSA-2023:5486
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2023:5488
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2024:10208
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2024:10207
Not affected: 22 products
  • A-MQ Clients 2
  • Logging Subsystem for Red Hat OpenShift
  • OpenShift Developer Tools and Services for OCP 4.11 for RHEL 8
  • OpenShift Service Mesh 2.1
  • Red Hat AMQ Broker 7
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Integration Camel K 1
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat JBoss Web Server 5
  • Red Hat OpenShift Application Runtimes
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenStack Platform 13 (Queens)
  • Red Hat Process Automation 7
  • Red Hat Quay 3
  • Red Hat Satellite 6
  • Red Hat Single Sign-On 7
  • Red Hat build of Quarkus

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-26464
  2. 2026-10-03 Alias added: GHSA-vp98-w2p3-mv35

References

Advisory 2

Other 3

  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
  • TI-2021-20393 Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack KEVCVSS 3.1CRITICAL 9.0
  • TI-2017-03645 Deserialization of untrusted data in Apache Log4j CVSS 3.1CRITICAL 9.8
  • TI-2019-13113 Deserialization of untrusted data in Apache Log4j CVSS 3.1CRITICAL 9.8
  • TI-2022-07428 SQL injection in JDBC Appender in Apache Log4j V1 CVSS 3.1CRITICAL 9.8
  • TI-2022-07425 Deserialization of untrusted data in JMSSink in Apache Log4j 1.x CVSS 3.1HIGH 8.8
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences