Maven/org.apache.logging.log4j:log4j-core CVE-2025-68161: medium 4.8, EPSS 0.77%
Apache Log4j does not verify the TLS hostname in its Socket Appender
Action: Upgrade org.apache.logging.log4j:log4j-core to 2.25.3 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.0-beta9 | 2.25.3 | - |
Fixed versions
| 2.25.3 |
Sources
- osv: GHSA-vc5p-v9hr-52mj
- nvd: CVE-2025-68161
- https://github.com/apache/logging-log4j2/pull/4002
- https://github.com/apache/logging-log4j2/commit/3b93748497e1adbbd027fda8a5e7268ec5d0d578
- https://github.com/apache/logging-log4j2
- https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx
- https://logging.apache.org/cyclonedx/vdr.xml
- https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName
- https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName
- https://logging.apache.org/security.html#CVE-2025-68161
- http://www.openwall.com/lists/oss-security/2025/12/18/1
CVE-2025-68161 · published · modified · JSON