Apache · Apache Log4J2 · CVE-2021-45105
**Name of the Vulnerable Software and Affected Versions**
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1)
**Description**
The issue allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted, due to uncontrolled recursion from self-referential lookups. This can lead to a denial of service. The problem is related to insufficient input validation in the logging library.
**Recommendations**
For Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1), update to Log4j 2.17.0, 2.12.3, or 2.3.1 to resolve the issue.
As a temporary workaround, consider restricting access to the `org.apache.logging.log4j:log4j-core` package to minimize the risk of exploitation.
Ensure the `org.apache.logging.log4j:log4j-api` package is kept at the same version as the `org.apache.logging.log4j:log4j-core` package to ensure compatibility if in use.