CVE-2021-45105: Apache Log4j2 uncontrolled recursion in self-referential lookups causes DoS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS is only medium (5.9) and exploitation requires control of Thread Context Map data, but the extremely high EPSS score and broad Log4j2 exposure make this a high-priority denial-of-service risk.

What it is

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) fail to protect against uncontrolled recursion from self-referential lookups. An attacker who controls Thread Context Map data can supply a crafted string that triggers infinite recursion and a denial of service. It was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

Impact

An attacker can crash or hang the logging path, causing denial of service for the affected application. There is no confidentiality or integrity impact per the CVSS vector.

Attack surface

Reachable over the network (AV:N) with no authentication (PR:N) and no user interaction (UI:N), but exploitation requires high complexity (AC:H) because the attacker must control Thread Context Map data that is interpreted as a lookup string.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high (0.99999, 99.991st percentile), indicating substantial observed exploitation activity; references include vendor advisories and mitigations.

What to do

• Upgrade Log4j2 to 2.17.0, or to 2.12.3 or 2.3.1 on the respective maintenance branches.
• If immediate upgrade is not possible, apply the mitigation guidance in the Apache Log4j security page and the Openwall oss-security post (e.g., restrict lookup evaluation in message lookups).
• Inventory applications and third-party products that bundle Log4j2 and confirm which versions are in use, including the listed vendor products.
• Remove or restrict untrusted input to Thread Context Map fields and avoid logging attacker-controlled data through lookup patterns.
• Monitor vendor advisories (Oracle, NetApp, Debian, SonicWall, Siemens, Cisco) for product-specific patches and apply them.

Detection

• Search application and system logs for repeated or recursive lookup patterns such as ${${...}} or nested ${} expressions in logged messages.
• Monitor for sudden logging failures, stack overflow errors, or application hangs correlated with requests containing lookup-like strings.
• Track Log4j2 versions in deployed artifacts and alert on any instance below 2.17.0 (or below 2.12.3/2.3.1 on those branches).
• Watch for abnormal CPU or thread growth in Java processes that use Log4j2, especially after requests that populate Thread Context Map data.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.