Vulnpedia
← All CVEs

CVE-2021-44228

CRITICAL 10 KNOWN EXPLOITED RANSOMWARE PoC CATALOGUED DETECTION TEMPLATE ALL-YEARS

Published 2021-12-10 · Last modified 2025-10-21 · apache · NVD: Analyzed

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

ACTIVELY EXPLOITED

Confirmed exploited in the wild — in CISA KEV since 2021-12-10, linked to ransomware campaigns. Patch or mitigate now.

Exploitation likelihood

100.0%chance of exploitation in 30 days · 100th percentile

● In CISA KEV (2021-12-10)● Catalogued PoC◆ SSVC: exploitation active, automatable yes

Impact if exploited

10CVSS 3.1 · CRITICAL · ADP

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ✓Access: Reachable over the network — no local access needed
  • ✓Privileges: No account or privileges required
  • ✓User interaction: No user interaction needed
  • ✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

Public PoC or exploit resources are catalogued below.

Listed by the named source; Vulnpedia has not tested these resources.

PoC data: JSON

Detection templates

Detection checks are listed separately from PoCs.

Resource commands

nuclei -id CVE-2021-44228 -u https://TARGETDetection template — review its checks and affected versions before use.
searchsploit --cve CVE-2021-44228 && searchsploit -m 51183Fetch the ExploitDB PoC locally; review the code before running it.
searchsploit --cve CVE-2021-44228 && searchsploit -m 50592Fetch the ExploitDB PoC locally; review the code before running it.
searchsploit --cve CVE-2021-44228 && searchsploit -m 50590Fetch the ExploitDB PoC locally; review the code before running it.
curl -s https://vulnpedia.com/cve/CVE-2021-44228/poc.jsonMachine-readable PoC index for this CVE (for automation).

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Apache Software Foundation Siemens Apache Intel Debian Fedoraproject Sonicwall Netapp Cisco Snowsoftware Bentley Percussion Apple

Products Apache Log4j2 6bk1602 0aa12 0tp0 Firmware 6bk1602 0aa12 0tp0 6bk1602 0aa22 0tp0 Firmware 6bk1602 0aa22 0tp0 6bk1602 0aa32 0tp0 Firmware 6bk1602 0aa32 0tp0 6bk1602 0aa42 0tp0 Firmware 6bk1602 0aa42 0tp0 6bk1602 0aa52 0tp0 Firmware 6bk1602 0aa52 0tp0 Log4j Sppa T3000 Ses3000 Firmware Sppa T3000 Ses3000 Capital Comos Desigo Cc Advanced Reports Desigo Cc Info Center E Car Operation Center Energy Engage Energyip Energyip Prepay Gma Manager Head End System Universal Device Integration System Industrial Edge Management Industrial Edge Management Hub Logo\! Soft Comfort Mendix Mindsphere Navigator Nx Opcenter Intelligence Operation Scheduler Sentron Powermanager Siguard Dsa Sipass Integrated Siveillance Command Siveillance Control Pro Siveillance Identity Siveillance Vantage

Weakness (CWE)

  • CWE-502: Deserialization of Untrusted Data
  • CWE-400: Uncontrolled Resource Consumption
  • CWE-20: Improper Input Validation
  • CWE-917: Expression language injection

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References and research data (JSON)

Packages and version ranges

Each advisory describes its own package and affected ranges. A boundary applies to that range; it is not a universal upgrade recommendation.

  • org.apache.logging.log4j:log4j-core Maven

    pkg:maven/org.apache.logging.log4j/log4j-core

    ECOSYSTEM range
    • Introduced version (included): 2.13.0
    • Fixed boundary (excluded): 2.15.0
    6 explicitly listed affected versions

    2.13.0, 2.13.1, 2.13.2, 2.13.3, 2.14.0, 2.14.1

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json"
  }
}
    GitHub Advisory Database · GHSA-jfh8-c2jp-5v3q · Updated 2025-10-22T19:37:02.616807Z
  • org.apache.logging.log4j:log4j-core Maven

    pkg:maven/org.apache.logging.log4j/log4j-core

    ECOSYSTEM range
    • Introduced version (included): 2.0-beta9
    • Fixed boundary (excluded): 2.3.1
    9 explicitly listed affected versions

    2.0, 2.0-beta9, 2.0-rc1, 2.0-rc2, 2.0.1, 2.0.2, 2.1, 2.2, 2.3

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json"
  }
}
    GitHub Advisory Database · GHSA-jfh8-c2jp-5v3q · Updated 2025-10-22T19:37:02.616807Z
  • org.apache.logging.log4j:log4j-core Maven

    pkg:maven/org.apache.logging.log4j/log4j-core

    ECOSYSTEM range
    • Introduced version (included): 2.4
    • Fixed boundary (excluded): 2.12.2
    18 explicitly listed affected versions

    2.10.0, 2.11.0, 2.11.1, 2.11.2, 2.12.0, 2.12.1, 2.4, 2.4.1, 2.5, 2.6, 2.6.1, 2.6.2, 2.7, 2.8, 2.8.1, 2.8.2, 2.9.0, 2.9.1

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json"
  }
}
    GitHub Advisory Database · GHSA-jfh8-c2jp-5v3q · Updated 2025-10-22T19:37:02.616807Z
  • com.guicedee.services:log4j-core Maven

    pkg:maven/com.guicedee.services/log4j-core

    ECOSYSTEM range
    • All earlier versions (introduced 0)
    • Last affected version (included): 1.2.1.2-jre17
    362 explicitly listed affected versions

    1.0.10.0, 1.0.10.0-jre13, 1.0.10.0-jre14, 1.0.10.1, 1.0.10.1-jre14, 1.0.10.3, 1.0.10.3-jre14, 1.0.10.4, 1.0.10.4-jre12, 1.0.10.4-jre13, 1.0.10.4-jre14, 1.0.11.0-jre14, 1.0.11.2-jre14, 1.0.11.5, 1.0.11.5-jre12, 1.0.11.5-jre14, 1.0.11.6-jre14, 1.0.11.7, 1.0.11.7-jre12, 1.0.11.7-jre14, 1.0.12.0, 1.0.12.0-jre12, 1.0.12.0-jre13, 1.0.12.0-jre14, 1.0.12.0-jre8, 1.0.12.1, 1.0.12.1-jre12, 1.0.12.1-jre14, 1.0.12.2, 1.0.12.2-jre12, 1.0.12.2-jre14, 1.0.12.3, 1.0.12.3-jre12, 1.0.12.3-jre13, 1.0.12.3-jre14, 1.0.12.4, 1.0.12.4-jre12, 1.0.12.4-jre13, 1.0.12.4-jre14, 1.0.12.4-jre8, 1.0.12.5, 1.0.12.5-jre14, 1.0.13.0, 1.0.13.0-jre12, 1.0.13.0-jre13, 1.0.13.0-jre14, 1.0.13.0-jre8, 1.0.13.1, 1.0.13.1-jre13, 1.0.13.1-jre14, 1.0.13.1-jre8, 1.0.13.2, 1.0.13.2-jre12, 1.0.13.2-jre13, 1.0.13.2-jre14, 1.0.13.2-jre8, 1.0.13.3, 1.0.13.3-jre14, 1.0.13.4, 1.0.13.4-jre12, 1.0.13.4-jre13, 1.0.13.4-jre14, 1.0.13.5, 1.0.13.5-jre12, 1.0.13.5-jre14, 1.0.13.5-jre8, 1.0.14.0-RC1-jre14, 1.0.14.0-RC1-jre8, 1.0.14.1, 1.0.14.1-jre12, 1.0.14.1-jre13, 1.0.14.1-jre14, 1.0.14.1-jre8, 1.0.14.3-jre8, 1.0.14.4-jre14, 1.0.14.4-jre8, 1.0.15.1, 1.0.15.1-jre12, 1.0.15.1-jre13, 1.0.15.1-jre14, 1.0.15.1-jre8, 1.0.15.2, 1.0.15.2-jre12, 1.0.15.2-jre14, 1.0.15.2-jre8, 1.0.15.3-jre14, 1.0.15.3-jre8, 1.0.15.4, 1.0.15.4-jre14, 1.0.15.4-jre8, 1.0.15.5, 1.0.15.5-jre14, 1.0.15.5-jre8, 1.0.16.0, 1.0.16.0-jre14, 1.0.16.0-jre8, 1.0.17.0, 1.0.17.0-jre14, 1.0.17.1, 1.0.17.1-jre14, 1.0.17.1-jre8, 1.0.18.0, 1.0.18.0-jre14, 1.0.18.0-jre15, 1.0.18.0-jre8, 1.0.18.1, 1.0.18.1-jre14, 1.0.18.1-jre15, 1.0.18.1-jre8, 1.0.19.0, 1.0.19.0-jre14, 1.0.19.0-jre15, 1.0.19.1, 1.0.19.1-jre12, 1.0.19.1-jre13, 1.0.19.1-jre14, 1.0.19.1-jre15, 1.0.19.1-jre8, 1.0.19.10, 1.0.19.10-jre12, 1.0.19.10-jre14, 1.0.19.10-jre15, 1.0.19.10-jre8, 1.0.19.11, 1.0.19.11-jre14, 1.0.19.11-jre8, 1.0.19.12-jre14, 1.0.19.12-jre8, 1.0.19.13, 1.0.19.13-jre14, 1.0.19.13-jre15, 1.0.19.13-jre8, 1.0.19.2, 1.0.19.2-jre13, 1.0.19.2-jre14, 1.0.19.2-jre15, 1.0.19.2-jre8, 1.0.19.3, 1.0.19.3-jre13, 1.0.19.3-jre14, 1.0.19.3-jre15, 1.0.19.3-jre8, 1.0.19.4, 1.0.19.4-jre14, 1.0.19.4-jre15, 1.0.19.4-jre8, 1.0.19.5, 1.0.19.5-jre14, 1.0.19.5-jre15, 1.0.19.5-jre8, 1.0.19.6, 1.0.19.6-jre14, 1.0.19.6-jre8, 1.0.19.7-jre14, 1.0.19.7-jre8, 1.0.19.8-jre8, 1.0.19.9, 1.0.19.9-jre13, 1.0.19.9-jre14, 1.0.19.9-jre15, 1.0.19.9-jre8, 1.0.2.15, 1.0.2.15-jre13, 1.0.2.16-jre13, 1.0.2.17-jre13, 1.0.2.18, 1.0.2.18-jre12, 1.0.2.18-jre13, 1.0.20.0, 1.0.20.0-jre14, 1.0.20.0-jre15, 1.0.20.0-jre8, 1.0.20.1, 1.0.20.1-jre14, 1.0.20.1-jre15, 1.0.20.1-jre8, 1.0.20.2, 1.0.20.2-jre14, 1.0.20.2-jre15, 1.0.20.2-jre8, 1.0.3.1-jre13, 1.0.3.2, 1.0.3.2-jre13, 1.0.3.3, 1.0.3.3-jre12, 1.0.3.3-jre13, 1.0.4.1-jre13, 1.0.4.2, 1.0.4.2-jre13, 1.0.4.3-jre13, 1.0.4.4, 1.0.4.4-jre13, 1.0.5.0, 1.0.5.0-jre13, 1.0.5.1, 1.0.5.1-jre12, 1.0.5.1-jre13, 1.0.5.2, 1.0.5.2-jre12, 1.0.5.2-jre13, 1.0.5.3, 1.0.5.3-jre12, 1.0.5.3-jre13, 1.0.5.4-jre13, 1.0.5.4-jre14, 1.0.5.5, 1.0.5.5-jre12, 1.0.5.5-jre13, 1.0.5.5-jre14, 1.0.6.1, 1.0.6.1-jre12, 1.0.6.1-jre13, 1.0.6.1-jre14, 1.0.6.2, 1.0.6.2-jre12, 1.0.6.2-jre13, 1.0.6.2-jre14, 1.0.6.3, 1.0.6.3-jre12, 1.0.6.3-jre13, 1.0.6.3-jre14, 1.0.6.4-jre14, 1.0.6.5, 1.0.6.5-jre12, 1.0.6.5-jre13, 1.0.6.5-jre14, 1.0.6.7, 1.0.6.7-jre14, 1.0.7.0, 1.0.7.0-jre12, 1.0.7.0-jre13, 1.0.7.0-jre14, 1.0.7.1, 1.0.7.1-jre13, 1.0.7.1-jre14, 1.0.7.10, 1.0.7.10-jre13, 1.0.7.10-jre14, 1.0.7.11, 1.0.7.11-jre14, 1.0.7.12, 1.0.7.12-jre12, 1.0.7.12-jre13, 1.0.7.12-jre14, 1.0.7.2-jre14, 1.0.7.3, 1.0.7.3-jre13, 1.0.7.3-jre14, 1.0.7.4, 1.0.7.4-jre14, 1.0.7.5, 1.0.7.5-jre14, 1.0.7.6, 1.0.7.6-jre14, 1.0.7.9, 1.0.7.9-jre14, 1.0.8.1, 1.0.8.1-jre14, 1.0.8.12, 1.0.8.12-jre12, 1.0.8.12-jre14, 1.0.8.16, 1.0.8.16-jre14, 1.0.8.18, 1.0.8.18-jre14, 1.0.8.2, 1.0.8.2-jre13, 1.0.8.2-jre14, 1.0.8.3, 1.0.8.3-jre13, 1.0.8.3-jre14, 1.0.8.4, 1.0.8.4-jre12, 1.0.8.4-jre13, 1.0.8.4-jre14, 1.0.8.5, 1.0.8.5-jre12, 1.0.8.5-jre13, 1.0.8.5-jre14, 1.0.8.6-jre14, 1.0.9.0, 1.0.9.0-jre14, 1.0.9.1, 1.0.9.1-jre14, 1.0.9.10, 1.0.9.10-jre14, 1.0.9.11, 1.0.9.11-jre14, 1.0.9.13, 1.0.9.13-jre14, 1.0.9.14, 1.0.9.14-jre14, 1.0.9.2, 1.0.9.2-jre14, 1.0.9.3-jre14, 1.0.9.4-jre14, 1.0.9.5-jre14, 1.0.9.7-jre14, 1.1.0.0-jre15, 1.1.0.1, 1.1.0.1-jre14, 1.1.0.1-jre15, 1.1.0.2, 1.1.0.2-jre14, 1.1.0.2-jre15, 1.1.0.3, 1.1.0.3-jre14, 1.1.0.3-jre15, 1.1.0.3-jre8, 1.1.0.4-jre14, 1.1.0.4-jre15, 1.1.0.4-jre8, 1.1.0.5-jre14, 1.1.0.5-jre15, 1.1.0.6, 1.1.0.6-jre14, 1.1.0.6-jre15, 1.1.0.7, 1.1.0.7-jre14, 1.1.0.7-jre15, 1.1.0.7-jre8, 1.1.0.8-SNAPSHOT-jre14, 1.1.1.0, 1.1.1.0-SNAPSHOT-jre14, 1.1.1.0-SNAPSHOT-jre15, 1.1.1.0-SNAPSHOT-jre8, 1.1.1.0-jre14, 1.1.1.0-jre15, 1.1.1.0-jre8, 1.1.1.1-SP1, 1.1.1.1-jre14-SP1, 1.1.1.1-jre15-SP1, 1.1.1.2, 1.1.1.2-jre14, 1.1.1.2-jre15, 1.1.1.3, 1.1.1.3-jre14, 1.1.1.3-jre15, 1.1.1.3-jre16, 1.1.1.3-jre8, 1.1.1.4, 1.1.1.4-jre14, 1.1.1.4-jre15, 1.1.1.4-jre16, 1.1.1.4-jre8, 1.1.1.5-jre15, 1.1.1.7, 1.1.1.7-jre15, 1.1.1.7-jre16, 1.1.1.7-jre8, 1.1.1.8-jre15, 1.1.1.8-jre16, 1.1.1.9-jre15, 1.1.1.9-jre16, 1.2.0.0-jre16, 1.2.0.1-jre11, 1.2.0.1-jre15, 1.2.0.1-jre16, 1.2.0.2-jre16, 1.2.0.3-jre17-rc1, 1.2.1.1-jre17, 1.2.1.2-jre17

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json"
  }
}
    GitHub Advisory Database · GHSA-jfh8-c2jp-5v3q · Updated 2025-10-22T19:37:02.616807Z
  • org.xbib.elasticsearch:log4j Maven

    pkg:maven/org.xbib.elasticsearch/log4j

    No range supplied.

    1 explicitly listed affected versions

    6.3.2.1

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json"
  }
}
    GitHub Advisory Database · GHSA-jfh8-c2jp-5v3q · Updated 2025-10-22T19:37:02.616807Z
  • uk.co.nichesolutions.logging.log4j:log4j-core Maven

    pkg:maven/uk.co.nichesolutions.logging.log4j/log4j-core

    No range supplied.

    1 explicitly listed affected versions

    2.6.3-CUSTOM

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json"
  }
}
    GitHub Advisory Database · GHSA-jfh8-c2jp-5v3q · Updated 2025-10-22T19:37:02.616807Z
  • org.ops4j.pax.logging:pax-logging-log4j2 Maven

    pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2

    ECOSYSTEM range
    • Introduced version (included): 1.8.0
    • Fixed boundary (excluded): 1.9.2
    10 explicitly listed affected versions

    1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.8.4, 1.8.5, 1.8.6, 1.8.7, 1.9.0, 1.9.1

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json"
  }
}
    GitHub Advisory Database · GHSA-jfh8-c2jp-5v3q · Updated 2025-10-22T19:37:02.616807Z
  • org.ops4j.pax.logging:pax-logging-log4j2 Maven

    pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2

    ECOSYSTEM range
    • Introduced version (included): 1.10.0
    • Fixed boundary (excluded): 1.10.8
    8 explicitly listed affected versions

    1.10.0, 1.10.1, 1.10.2, 1.10.3, 1.10.4, 1.10.5, 1.10.6, 1.10.7

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json"
  }
}
    GitHub Advisory Database · GHSA-jfh8-c2jp-5v3q · Updated 2025-10-22T19:37:02.616807Z
  • org.ops4j.pax.logging:pax-logging-log4j2 Maven

    pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2

    ECOSYSTEM range
    • Introduced version (included): 1.11.0
    • Fixed boundary (excluded): 1.11.10
    10 explicitly listed affected versions

    1.11.0, 1.11.1, 1.11.2, 1.11.3, 1.11.4, 1.11.5, 1.11.6, 1.11.7, 1.11.8, 1.11.9

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json"
  }
}
    GitHub Advisory Database · GHSA-jfh8-c2jp-5v3q · Updated 2025-10-22T19:37:02.616807Z
  • org.ops4j.pax.logging:pax-logging-log4j2 Maven

    pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2

    ECOSYSTEM range
    • Introduced version (included): 2.0.0
    • Fixed boundary (excluded): 2.0.11
    11 explicitly listed affected versions

    2.0.0, 2.0.1, 2.0.10, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9

    Additional upstream package constraints
    {
  "database": {
    "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-jfh8-c2jp-5v3q/GHSA-jfh8-c2jp-5v3q.json"
  }
}
    GitHub Advisory Database · GHSA-jfh8-c2jp-5v3q · Updated 2025-10-22T19:37:02.616807Z

Vendor product assessments

Showing 32 of 2380 vendor product statements; 2348 omitted. Read the full vendor advisory.

  • eap7-apache-cxf-0:3.1.16-4.redhat_00003.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_00003.1.ep7.el7?arch=noarch

    • vendor fix: Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: For Log4j versions >=2.10 set the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true For Log4j versions >=2.7 and <=2.14.1 all PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m For Log4j versions >=2.0-beta9 and <=2.10.0 remove the JndiLookup class from the classpath. For example: ``` zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class ``` On OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421 On OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441
    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • eap7-netty-0:4.1.63-1.Final_redhat_00002.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_redhat_00002.1.ep7.el7?arch=noarch

    • vendor fix: Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: For Log4j versions >=2.10 set the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true For Log4j versions >=2.7 and <=2.14.1 all PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m For Log4j versions >=2.0-beta9 and <=2.10.0 remove the JndiLookup class from the classpath. For example: ``` zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class ``` On OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421 On OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441
    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • eap7-resteasy-jackson2-provider-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_redhat_00001.1.ep7.el7?arch=noarch

    • vendor fix: Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: For Log4j versions >=2.10 set the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true For Log4j versions >=2.7 and <=2.14.1 all PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m For Log4j versions >=2.0-beta9 and <=2.10.0 remove the JndiLookup class from the classpath. For example: ``` zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class ``` On OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421 On OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441
    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • eap7-resteasy-validator-provider-11-0:3.0.27-1.Final_redhat_00001.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_redhat_00001.1.ep7.el7?arch=noarch

    • vendor fix: Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: For Log4j versions >=2.10 set the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true For Log4j versions >=2.7 and <=2.14.1 all PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m For Log4j versions >=2.0-beta9 and <=2.10.0 remove the JndiLookup class from the classpath. For example: ``` zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class ``` On OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421 On OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441
    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • eap7-hal-console-0:3.2.17-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_redhat_00001.1.el7eap?arch=noarch

    • vendor fix: Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: For Log4j versions >=2.10 set the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true For Log4j versions >=2.7 and <=2.14.1 all PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m For Log4j versions >=2.0-beta9 and <=2.10.0 remove the JndiLookup class from the classpath. For example: ``` zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class ``` On OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421 On OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441
    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • eap7-jackson-jaxrs-base-0:2.10.4-2.redhat_00004.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_00004.1.el7eap?arch=noarch

    • vendor fix: Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: For Log4j versions >=2.10 set the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true For Log4j versions >=2.7 and <=2.14.1 all PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m For Log4j versions >=2.0-beta9 and <=2.10.0 remove the JndiLookup class from the classpath. For example: ``` zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class ``` On OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421 On OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441
    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • eap7-jettison-0:1.5.2-2.redhat_00002.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_00002.1.el7eap?arch=src

    • vendor fix: Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: For Log4j versions >=2.10 set the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true For Log4j versions >=2.7 and <=2.14.1 all PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m For Log4j versions >=2.0-beta9 and <=2.10.0 remove the JndiLookup class from the classpath. For example: ``` zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class ``` On OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421 On OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441
    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • eap7-resteasy-client-microprofile-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_redhat_00001.1.el7eap?arch=noarch

    • vendor fix: Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: For Log4j versions >=2.10 set the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true For Log4j versions >=2.7 and <=2.14.1 all PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m For Log4j versions >=2.0-beta9 and <=2.10.0 remove the JndiLookup class from the classpath. For example: ``` zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class ``` On OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421 On OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441
    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • eap7-resteasy-json-binding-provider-0:3.11.6-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_redhat_00001.1.el7eap?arch=noarch

    • vendor fix: Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: For Log4j versions >=2.10 set the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true For Log4j versions >=2.7 and <=2.14.1 all PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m For Log4j versions >=2.0-beta9 and <=2.10.0 remove the JndiLookup class from the classpath. For example: ``` zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class ``` On OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421 On OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441
    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • eap7-wildfly-0:7.3.12-3.GA_redhat_00002.1.el7eap.src as a component of Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_redhat_00002.1.el7eap?arch=src

    • vendor fix: Before applying this update, ensure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: For Log4j versions >=2.10 set the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true For Log4j versions >=2.7 and <=2.14.1 all PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m For Log4j versions >=2.0-beta9 and <=2.10.0 remove the JndiLookup class from the classpath. For example: ``` zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class ``` On OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421 On OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441
    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • openshift-logging/elasticsearch6-rhel8@sha256:315b9b9057b2893d0e14fe7c3e2809066ce90b5b42863934de93734ee26d212c_s390x as a component of OpenShift Logging 5.1 · fixed

    Vendor assessment for this product only.

    pkg:oci/elasticsearch6-rhel8@sha256:315b9b9057b2893d0e14fe7c3e2809066ce90b5b42863934de93734ee26d212c?arch=s390x&repository_url=registry.redhat.io/openshift-logging/elasticsearch6-rhel8&tag=v6.8.1-67

    • vendor fix: For OpenShift Container Platform 4.8 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update: https://docs.openshift.com/container-platform/4.8/release_notes/ocp-4-8-release-notes.html For Red Hat OpenShift Logging 5.1, see the following instructions to apply this update: https://docs.openshift.com/container-platform/4.8/logging/cluster-logging-upgrading.html Vendor guidance
    • workaround: For Log4j versions >=2.10 set the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true For Log4j versions >=2.7 and <=2.14.1 all PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m For Log4j versions >=2.0-beta9 and <=2.10.0 remove the JndiLookup class from the classpath. For example: ``` zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class ``` On OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421 On OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441
    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • openshift4/ose-logging-elasticsearch6@sha256:416510e6e489dfb1ab1f0b2091015dcb0adac637ed37f1e18d30f128c45b93d2_s390x as a component of Red Hat OpenShift Container Platform 4.6 · fixed

    Vendor assessment for this product only.

    pkg:oci/ose-logging-elasticsearch6@sha256:416510e6e489dfb1ab1f0b2091015dcb0adac637ed37f1e18d30f128c45b93d2?arch=s390x&repository_url=registry.redhat.io/openshift4/ose-logging-elasticsearch6&tag=v4.6.0-202112132021.p0.g2a13a81.assembly.stream

    • vendor fix: For OpenShift Container Platform 4.6 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.6/release_notes/ocp-4-6-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.6/updating/updating-cluster-cli.html Vendor guidance
    • workaround: For Log4j versions >=2.10 set the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true For Log4j versions >=2.7 and <=2.14.1 all PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m For Log4j versions >=2.0-beta9 and <=2.10.0 remove the JndiLookup class from the classpath. For example: ``` zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class ``` On OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421 On OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441
    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • RHPAM 7.12.0 · fixed

    Vendor assessment for this product only.

    • vendor fix: For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process. The References section of this erratum contains a download link (you must log in to download the update). Vendor guidance
    • workaround: For Log4j versions >=2.10 set the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true For Log4j versions >=2.7 and <=2.14.1 all PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m For Log4j versions >=2.0-beta9 and <=2.10.0 remove the JndiLookup class from the classpath. For example: ``` zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class ``` On OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421 On OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441
    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • Vert.x 4.1.5 SP1 · fixed

    Vendor assessment for this product only.

    • vendor fix: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link for the update. You must be logged in to download the update. Vendor guidance
    • workaround: For Log4j versions >=2.10 set the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true For Log4j versions >=2.7 and <=2.14.1 all PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m For Log4j versions >=2.0-beta9 and <=2.10.0 remove the JndiLookup class from the classpath. For example: ``` zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class ``` On OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421 On OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441
    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • log4j-core as a component of Red Hat Integration Camel Quarkus 1 · known affected

    Vendor assessment for this product only.

    pkg:maven/org.apache.logging.log4j/log4j-core

    • workaround: For Log4j versions >=2.10 set the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true For Log4j versions >=2.7 and <=2.14.1 all PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m For Log4j versions >=2.0-beta9 and <=2.10.0 remove the JndiLookup class from the classpath. For example: ``` zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class ``` On OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421 On OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441
    • none available: Affected
    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • log4j-core as a component of Red Hat JBoss Enterprise Application Platform 7 · known affected

    Vendor assessment for this product only.

    pkg:maven/org.apache.logging.log4j/log4j-core

    • workaround: For Log4j versions >=2.10 set the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true For Log4j versions >=2.7 and <=2.14.1 all PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m For Log4j versions >=2.0-beta9 and <=2.10.0 remove the JndiLookup class from the classpath. For example: ``` zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class ``` On OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421 On OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441
    • none available: Affected
    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • opendaylight as a component of Red Hat OpenStack Platform 13 (Queens) · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/opendaylight

    • workaround: For Log4j versions >=2.10 set the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true For Log4j versions >=2.7 and <=2.14.1 all PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m For Log4j versions >=2.0-beta9 and <=2.10.0 remove the JndiLookup class from the classpath. For example: ``` zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class ``` On OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421 On OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441
    • no fix planned: Out of support scope
    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • opendaylight.src as a component of Red Hat OpenStack Platform 13 (Queens) · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/opendaylight?arch=src

    • workaround: For Log4j versions >=2.10 set the system property log4j2.formatMsgNoLookups or the environment variable LOG4J_FORMAT_MSG_NO_LOOKUPS to true For Log4j versions >=2.7 and <=2.14.1 all PatternLayout patterns can be modified to specify the message converter as %m{nolookups} instead of just %m For Log4j versions >=2.0-beta9 and <=2.10.0 remove the JndiLookup class from the classpath. For example: ``` zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class ``` On OpenShift 4 and in OpenShift Logging, the above mitigation can be applied by following the steps in this article: https://access.redhat.com/solutions/6578421 On OpenShift 3.11, mitigation to the affected Elasticsearch component can be applied by following the steps in this article: https://access.redhat.com/solutions/6578441
    • no fix planned: Out of support scope
    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • openshift-logging/cluster-logging-operator-bundle@sha256:8506f609ee7aae7006f856c9aea1868adbe0689e142d88a7db9fe1a5178f3178_amd64 as a component of OpenShift Logging 5.0 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/cluster-logging-operator-bundle@sha256:8506f609ee7aae7006f856c9aea1868adbe0689e142d88a7db9fe1a5178f3178?arch=amd64&repository_url=registry.redhat.io/openshift-logging/cluster-logging-operator-bundle&tag=v5.0.10-2

    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • None.amdefine-1.0.1 as a component of Red Hat JBoss Enterprise Application Platform · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:npm/[email protected]

    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • None.define-property-1.0.0 as a component of Red Hat JBoss Enterprise Application Platform · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:npm/[email protected]

    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • None.is-buffer-2.0.3 as a component of Red Hat JBoss Enterprise Application Platform · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:npm/[email protected]

    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • None.path-parse-1.0.6 as a component of Red Hat JBoss Enterprise Application Platform · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:npm/[email protected]

    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • None.use-3.1.1 as a component of Red Hat JBoss Enterprise Application Platform · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:npm/[email protected]

    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • io.netty.netty-transport-sctp-4.1.72.Final-redhat-00001.pom as a component of Red Hat JBoss Enterprise Application Platform · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:maven/io.netty/[email protected]?type=pom

    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • org.apache.logging.log4j.log4j-api-2.17.1.redhat-00002.pom as a component of Red Hat JBoss Enterprise Application Platform · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:maven/org.apache.logging.log4j/[email protected]?type=pom

    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • org.jboss.eap.wildfly-bean-validation-7.4.5.GA-redhat-00001.pom as a component of Red Hat JBoss Enterprise Application Platform · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:maven/org.jboss.eap/[email protected]?type=pom

    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • org.jboss.ironjacamar.ironjacamar-common-api-1.5.3.Final-redhat-00001.jar as a component of Red Hat JBoss Enterprise Application Platform · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:maven/org.jboss.ironjacamar/[email protected]?type=jar

    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • org.jboss.resteasy.resteasy-cdi-3.15.3.Final-redhat-00001.jar as a component of Red Hat JBoss Enterprise Application Platform · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:maven/org.jboss.resteasy/[email protected]?type=jar

    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • org.opensaml.opensaml-xacml-saml-api-3.3.1.redhat-00002.pom as a component of Red Hat JBoss Enterprise Application Platform · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:maven/org.opensaml/[email protected]?type=pom

    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • org.wildfly.security.wildfly-elytron-credential-store-1.15.12.Final-redhat-00001.jar as a component of Red Hat JBoss Enterprise Application Platform · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:maven/org.wildfly.security/[email protected]?type=jar

    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00
  • stf/sg-core-rhel8 as a component of Service Telemetry Framework 1.3 for RHEL 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/sg-core-rhel8?repository_url=registry.redhat.io/stf/sg-core-rhel8

    Red Hat · CVE-2021-44228 · Updated 2026-09-11T13:45:16+00:00

Unverified PoC candidates

Catalogue matches for further research. These repositories have not been validated as working exploits.

470 candidates

Additional exploitation reports

Source-specific reports, separate from CISA KEV. Repeated observations from one source are not independent confirmations.

1178 more source reports

All CVSS metrics

  • CRITICAL 10 v3.1 · ADP Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
  • CRITICAL 10 v3.1 · NVD Primary
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
  • HIGH 9.3 v2.0 · NVD Primary
    AV:N/AC:M/Au:N/C:C/I:C/A:C

References

Exploit-tagged references (not proof of a PoC)

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS