CVE-2025-68161
published 2025-12-18CVE-2025-68161: The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the…
PriorityP427medium4.8CVSS 3.1
AVNACHPRNUINSUCLILAN
EPSS
0.76%
51.0th percentile
The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true.
This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:
* The attacker is able to intercept or redirect network traffic between the client and the log receiver.
* The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured).
Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue.
As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | log4j | — | — |
| apache | log4j | — | — |
| apache | log4j | >= 2.0.1 < 2.25.3 | 2.25.3 |
| apache | log4j | >= 2.12.0 < 2.25.4 | 2.25.4 |
| apache | logging | — | — |
| apache_software_foundation | apache_log4j_core | >= 2.12.0 < 2.25.4 | 2.25.4 |
| apache_software_foundation | apache_log4j_core | 3.0.0-alpha1 – 3.0.0-beta3 | — |
| debian | apache-log4j2 | < apache-log4j2 2.17.1-1~deb11u2 (bullseye) | apache-log4j2 2.17.1-1~deb11u2 (bullseye) |
| msrc | azl3_javapackages-bootstrap_1.14.0-3_on_azure_linux_3.0 | — | — |
CVSS provenance
nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
ghsa6.3MEDIUM
osv6.3MEDIUM
vendor_apache6.3
vendor_debian6.3MEDIUM
vendor_msrc6.3MEDIUM
vendor_redhat6.3MEDIUM
vendor_oracle5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6hg6-v5c8-fphq: The fix for CVE-2025-68161 https://logging
ghsa_unreviewed·2026-04-10·CVSS 6.3
CVE-2026-34477 [MEDIUM] CWE-297 GHSA-6hg6-v5c8-fphq: The fix for CVE-2025-68161 https://logging
The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the element.
Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.
A network-based attacker may be able to perform a man-in-the-middle attack when all of the f
GHSA
Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration
ghsa·2026-04-10·CVSS 6.3
CVE-2026-34477 [MEDIUM] CWE-297 Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration
Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration
The fix for CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the [`log4j2.sslVerifyHostName`](https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName) system property, but not when configured through the [`verifyHostName`](https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName) attribute of the `` element.
Although the `verifyHostName` configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value.
A network-based attacker may be able to perform
OSV
Apache Log4j does not verify the TLS hostname in its Socket Appender
osv·2025-12-18
CVE-2025-68161 [MEDIUM] Apache Log4j does not verify the TLS hostname in its Socket Appender
Apache Log4j does not verify the TLS hostname in its Socket Appender
The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the [verifyHostName](https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName) configuration attribute or the [log4j2.sslVerifyHostName](https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName) system property is set to true.
This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:
* The attacker is able to intercept or redirect network traffic between the client and the log receiver.
* The attacker can present a server certifi
OSV
CVE-2025-68161: The Socket Appender in Apache Log4j Core versions 2
osv·2025-12-18·CVSS 6.3
CVE-2025-68161 [MEDIUM] CVE-2025-68161: The Socket Appender in Apache Log4j Core versions 2
The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true. This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions: * The attacker is able to intercept or redirect network traffic between the client and the log receiver. * The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s conf
GHSA
Apache Log4j does not verify the TLS hostname in its Socket Appender
ghsa·2025-12-18
CVE-2025-68161 [MEDIUM] CWE-297 Apache Log4j does not verify the TLS hostname in its Socket Appender
Apache Log4j does not verify the TLS hostname in its Socket Appender
The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the [verifyHostName](https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName) configuration attribute or the [log4j2.sslVerifyHostName](https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName) system property is set to true.
This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:
* The attacker is able to intercept or redirect network traffic between the client and the log receiver.
* The attacker can present a server certifi
Oracle
Oracle Oracle GoldenGate Risk Matrix: Third Party (Apache Log4j) — CVE-2025-68161
vendor_oracle·2026-01-15·CVSS 5.4
CVE-2025-68161 [MEDIUM] Oracle Oracle GoldenGate Risk Matrix: Third Party (Apache Log4j) — CVE-2025-68161
Oracle Oracle GoldenGate Risk Matrix: Third Party (Apache Log4j) vulnerability
CVE: CVE-2025-68161
CVSS: 5.4
Protocol: TLS
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2026 (JAN 2026)
Red Hat
Apache Log4j: Apache Log4j Core: Information disclosure via missing TLS hostname verification
vendor_redhat·2025-12-18·CVSS 6.3
CVE-2025-68161 [MEDIUM] CWE-297 Apache Log4j: Apache Log4j Core: Information disclosure via missing TLS hostname verification
Apache Log4j: Apache Log4j Core: Information disclosure via missing TLS hostname verification
The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true.
This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:
* The attacker is able to intercept or redirect network traffic between the client and the log receiver.
* The attacker can present
Microsoft
Apache Log4j Core: Missing TLS hostname verification in Socket appender
vendor_msrc·2025-12-09·CVSS 6.3
CVE-2025-68161 [MEDIUM] CWE-297 Apache Log4j Core: Missing TLS hostname verification in Socket appender
Apache Log4j Core: Missing TLS hostname verification in Socket appender
Mariner: Mariner
apache: apache
Customer Action Required: Yes
Debian
CVE-2025-68161: apache-log4j2 - The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does ...
vendor_debian·2025·CVSS 6.3
CVE-2025-68161 [MEDIUM] CVE-2025-68161: apache-log4j2 - The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does ...
The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true. This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions: * The attacker is able to intercept or redirect network traffic between the client and the log receiver. * The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s conf
Apache
Apache logging: CVE-2025-68161
vendor_apache·CVSS 6.3
CVE-2025-68161 Apache logging: CVE-2025-68161
Apache logging: CVE-2025-68161
Summary Missing TLS hostname verification in Socket appender CVSS 4.x Score & Vector 6.3 MEDIUM (CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N) Components affected Log4j Core Versions affected [2.0-beta9, 2.25.3) Versions fixed 2.25.3
Severity: moderate
Affected versions: 2.25.3
No detection rules found.
No public exploits indexed.
Wiz
CVE-2025-12107 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.7
CVE-2025-12107 [HIGH] CVE-2025-12107 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-12107 :
WSO2 Identity Server vulnerability analysis and mitigation
Due to the use of a vulnerable third-party Velocity template engine, a malicious actor with admin privilege may inject and execute arbitrary template syntax within server-side templates.
Successful exploitation of this vulnerability could allow a malicious actor with admin privilege to inject and execute arbitrary template code on the server, potentially leading to remote code execution, data manipulation, or unauthorized access to sensitive information.
Source : NVD
## 7.2
Score
Published February 19, 2026
Severity HIGH
CNA Score 8.4
Affected Technologies
WSO2 Identity Server
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability
Wiz
CVE-2026-22735 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.3
CVE-2026-22735 [MEDIUM] CVE-2026-22735 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-22735 :
Apache Log4j vulnerability analysis and mitigation
Spring MVC and WebFlux applications are vulnerable to stream corruption when using Server-Sent Events (SSE). This issue affects Spring Foundation: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.
Source : NVD
## 2.6
Score
Published March 20, 2026
Severity LOW
CNA Score 2.6
Affected Technologies
Apache Log4j
Wolfi
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 7.3
Exploitation Probability (EPSS) N/A
Affected packages and libraries
kafbat-ui
kafbat-ui-fips
Sources
NVD
Chainguard Has Fix Added at: Mar 29, 2026
Debian 11, 12, 13, 14 Severity LOW No Fix
Wiz
CVE-2026-22737 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.3
CVE-2026-22737 [MEDIUM] CVE-2026-22737 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-22737 :
Apache Log4j vulnerability analysis and mitigation
Use of Java scripting engine enabled (e.g. JRuby, Jython) template views in Spring MVC and Spring WebFlux applications can result in disclosure of content from files outside the configured locations for script template views. This issue affects Spring Framework: from 7.0.0 through 7.0.5, from 6.2.0 through 6.2.16, from 6.1.0 through 6.1.25, from 5.3.0 through 5.3.46.
Source : NVD
## 5.9
Score
Published March 20, 2026
Severity MEDIUM
CNA Score 5.9
Affected Technologies
Apache Log4j
Wolfi
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 19.5
Exploitation Probability (EPSS) 0.1
Affected packages and libraries
log4j:
Wiz
CVE-2025-68161 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.3
CVE-2025-68161 [MEDIUM] CVE-2025-68161 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-68161 :
Apache Solr vulnerability analysis and mitigation
The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true.
This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:
The attacker is able to intercept or redirect network traffic between the client and the log receiver.
The attacker can present a server certificate is
Bugzilla
CVE-2026-34477 org.apache.logging.log4j/log4j-core: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification
bugzilla·2026-04-10·CVSS 6.3
CVE-2026-34477 [MEDIUM] CVE-2026-34477 org.apache.logging.log4j/log4j-core: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification
CVE-2026-34477 org.apache.logging.log4j/log4j-core: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification
The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the element.
Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to inter
Bugzilla
CVE-2025-68161 javapackages-bootstrap: Apache Log4j Core: Missing TLS hostname verification in Socket appender [fedora-42]
bugzilla·2026-01-08·CVSS 6.3
CVE-2025-68161 [MEDIUM] CVE-2025-68161 javapackages-bootstrap: Apache Log4j Core: Missing TLS hostname verification in Socket appender [fedora-42]
CVE-2025-68161 javapackages-bootstrap: Apache Log4j Core: Missing TLS hostname verification in Socket appender [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It i
Bugzilla
CVE-2025-68161 log4j: Apache Log4j Core: Missing TLS hostname verification in Socket appender [fedora-42]
bugzilla·2026-01-08·CVSS 6.3
CVE-2025-68161 [MEDIUM] CVE-2025-68161 log4j: Apache Log4j Core: Missing TLS hostname verification in Socket appender [fedora-42]
CVE-2025-68161 log4j: Apache Log4j Core: Missing TLS hostname verification in Socket appender [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy
Bugzilla
CVE-2025-68161 texlive-base: Apache Log4j Core: Missing TLS hostname verification in Socket appender [fedora-42]
bugzilla·2026-01-08·CVSS 6.3
CVE-2025-68161 [MEDIUM] CVE-2025-68161 texlive-base: Apache Log4j Core: Missing TLS hostname verification in Socket appender [fedora-42]
CVE-2025-68161 texlive-base: Apache Log4j Core: Missing TLS hostname verification in Socket appender [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's
Bugzilla
CVE-2025-68161 Apache Log4j: Apache Log4j Core: Information disclosure via missing TLS hostname verification
bugzilla·2025-12-18·CVSS 4.8
CVE-2025-68161 [MEDIUM] CVE-2025-68161 Apache Log4j: Apache Log4j Core: Information disclosure via missing TLS hostname verification
CVE-2025-68161 Apache Log4j: Apache Log4j Core: Information disclosure via missing TLS hostname verification
The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true.
This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions:
* The attacker is able to intercept or redirect network traffic between the client and the log receiver.
* The att
https://github.com/apache/logging-log4j2/pull/4002https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvxhttps://logging.apache.org/cyclonedx/vdr.xmlhttps://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostNamehttps://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostNamehttps://logging.apache.org/security.html#CVE-2025-68161http://www.openwall.com/lists/oss-security/2025/12/18/1https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html
2025-12-18
Published