{"action":"Upgrade org.apache.logging.log4j:log4j-core to 2.25.3 or later.","affected":[{"fixed":"2.25.3","introduced":"2.0-beta9"}],"component":"org.apache.logging.log4j:log4j-core","cve_ids":["CVE-2025-68161"],"ecosystem":"Maven","epss":0.00767,"exploited":false,"fixed_versions":["2.25.3"],"ghsa_id":"GHSA-vc5p-v9hr-52mj","id":"tcs_01M5N9DT9FGT8SA0W482RYKZKR","modified_at":"2026-09-10T03:50:32.126499218Z","published_at":"2025-12-18T21:31:44Z","references":["https://osv.dev/vulnerability/GHSA-vc5p-v9hr-52mj","https://nvd.nist.gov/vuln/detail/CVE-2025-68161","https://github.com/apache/logging-log4j2/pull/4002","https://github.com/apache/logging-log4j2/commit/3b93748497e1adbbd027fda8a5e7268ec5d0d578","https://github.com/apache/logging-log4j2","https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName","https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName","https://logging.apache.org/security.html#CVE-2025-68161","http://www.openwall.com/lists/oss-security/2025/12/18/1"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-vc5p-v9hr-52mj","url":"https://osv.dev/vulnerability/GHSA-vc5p-v9hr-52mj"},{"source":"nvd","source_id":"CVE-2025-68161","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68161"}],"summary":"Apache Log4j does not verify the TLS hostname in its Socket Appender"}