CVE-2023-26464

CWE-502 — Deserialization of Untrusted DataCWE-400 — Uncontrolled Resource Consumption9 documents8 sources
Severity
7.5HIGH
EPSS
0.1%
top 64.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache Software Foundation Apache Log4jApache Log4j
Timeline
PublishedMar 10
Latest updateApr 15

Description

** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested) hashmap or hashtable (depending on which logging component is in use) to be processed could exhaust the available memory in the virtual machine and achieve Denial of Service when the object is deserialized. This issue affects Apache Log4j before 2. Affected users are recommen…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶NVDapache/log4j1.0.4 — 2.0
▶Mavenlog4j:log4j1.0.4 — 2.0

🔴Vulnerability Details

5
OSV
CVE-2023-26464: ** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender components with Log4j 1↗2023-03-10
▶
OSV
Apache Log4j 1.x (EOL) allows Denial of Service (DoS)↗2023-03-10
▶
GHSA
Apache Log4j 1.x (EOL) allows Denial of Service (DoS)↗2023-03-10
▶
CVEList
Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender↗2023-03-10
▶
VulnCheck
Apache log4j Deserialization of Untrusted Data↗2023
▶

📋Vendor Advisories

3
Oracle
Oracle Oracle Food and Beverage Applications Risk Matrix: Installation (Apache Log4j) — CVE-2023-26464↗2025-04-15
▶
Red Hat
log4j1-socketappender: DoS via hashmap logging↗2023-03-15
▶
Debian
CVE-2023-26464: apache-log4j1.2 - ** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or SocketAppender compo...↗2023
▶
CVE-2023-26464 (HIGH CVSS 7.5) | ** UNSUPPORTED WHEN ASSIGNED ** Whe | cvebase.io