--- title: "CVE-2019-17571: Deserialization of Untrusted Data | CubePath" description: "Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute…" language: en source: https://cubepath.com/security/cve/CVE-2019-17571 --- # CVE-2019-17571: Deserialization of Untrusted Data | CubePath ## Description Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17. Official description from the CVE record, published by apache. Copyright © 1999-2026 The MITRE Corporation. See [/security/cve/legal](https://cubepath.com/security/cve/legal) for the CVE license. [View the record on cve.org](https://www.cve.org/CVERecord?id=CVE-2019-17571) ## Key data ### CVSS 3.1 Critical 9.8 Score published by CISA-ADP in the CVE record. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | Metric | Value | What it means | | ---------------------- | --------- | ----------------------------------------------------------------------------------- | | Attack vector | Network | The vulnerable component can be reached over a network, possibly from the Internet. | | Attack complexity | Low | No special conditions are needed. The attack can be repeated at will. | | Privileges required | None | No account or privileges are needed. | | User interaction | None | No action from any user is needed. | | Scope | Unchanged | The impact stays within the vulnerable component. | | Confidentiality impact | High | Serious or total effect on the secrecy of data. | | Integrity impact | High | Serious or total effect on the trustworthiness of data. | | Availability impact | High | Serious or total effect on availability. | CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and is used by permission. Each CVSS score on this site is shown together with its vector string, as published in the CVE record by the source named next to it. Learn more at [first.org/cvss](https://www.first.org/cvss/) . ### EPSS Exploit Prediction Scoring System by FIRST: an estimate of the probability that exploitation activity will be observed in the next 30 days. Score 0.69980 (70.0% probability) Percentile 99.4% Scores of Nov 10, 2026 Model v2026.06.15 ### CISA assessment as of May 28, 2026 Stakeholder-Specific Vulnerability Categorization (SSVC) decision points added by CISA. Automatable yes Technical impact total ### Weakness (CWE) CWE catalog version 5.0. CWE names: Copyright © 2006-2026, The MITRE Corporation. See [/security/cve/legal](https://cubepath.com/security/cve/legal) for the CWE license. - [CWE-502](https://cwe.mitre.org/data/definitions/502.html) Deserialization of Untrusted Data ## Affected products Products listed in the CVE record, as the CNA published them. - Apache Software Foundation Log4j - affected: versions up to 1.2.17 ## References Links listed in the CVE record. They lead to other sites, which CubePath does not control. - [\[activemq-issues\] 20191226 \[jira\] \[Created\] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571](https://lists.apache.org/thread.html/8ab32b4c9f1826f20add7c40be08909de9f58a89dc1de9c09953f5ac%40%3Cissues.activemq.apache.org%3E) (lists.apache.org) mailing-list - [\[tika-dev\] 20191226 \[jira\] \[Created\] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571](https://lists.apache.org/thread.html/44491fb9cc19acc901f7cff34acb7376619f15638439416e3e14761c%40%3Cdev.tika.apache.org%3E) (lists.apache.org) mailing-list - [\[tika-dev\] 20191226 \[jira\] \[Commented\] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571](https://lists.apache.org/thread.html/277b4b5c2b0e06a825ccec565fa65bd671f35a4d58e3e2ec5d0618e1%40%3Cdev.tika.apache.org%3E) (lists.apache.org) mailing-list - [\[tika-dev\] 20191230 \[jira\] \[Created\] (TIKA-3019) \[9.8\] \[CVE-2019-17571\] \[tika-app\] \[1.23\]](https://lists.apache.org/thread.html/479471e6debd608c837b9815b76eab24676657d4444fcfd5ef96d6e6%40%3Cdev.tika.apache.org%3E) (lists.apache.org) mailing-list - [\[activemq-issues\] 20191230 \[jira\] \[Created\] (AMQ-7372) \[9.8\] \[CVE-2019-17571\] \[activemq-all\] \[5.15.10\]](https://lists.apache.org/thread.html/6114ce566200d76e3cc45c521a62c2c5a4eac15738248f58a99f622c%40%3Cissues.activemq.apache.org%3E) (lists.apache.org) mailing-list - [\[kafka-jira\] 20200105 \[jira\] \[Created\] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571](https://lists.apache.org/thread.html/564f03b4e9511fcba29c68fc0299372dadbdb002718fa8edcc4325e4%40%3Cjira.kafka.apache.org%3E) (lists.apache.org) mailing-list - [\[kafka-jira\] 20200105 \[jira\] \[Updated\] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571](https://lists.apache.org/thread.html/r2756fd570b6709d55a61831ca028405bcb3e312175a60bc5d911c81f%40%3Cjira.kafka.apache.org%3E) (lists.apache.org) mailing-list - [\[kafka-dev\] 20200105 \[jira\] \[Created\] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571](https://lists.apache.org/thread.html/752ec92cd1e334a639e79bfbd689a4ec2c6579ec5bb41b53ffdf358d%40%3Cdev.kafka.apache.org%3E) (lists.apache.org) mailing-list - [\[kafka-jira\] 20200106 \[jira\] \[Commented\] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571](https://lists.apache.org/thread.html/r189aaeaad897f7d6b96f7c43a8ef2dfb9f6e9f8c1cc9ad182ce9b9ae%40%3Cjira.kafka.apache.org%3E) (lists.apache.org) mailing-list - [\[kafka-jira\] 20200106 \[jira\] \[Assigned\] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571](https://lists.apache.org/thread.html/r3c575cabc7386e646fb12cb82b0b38ae5a6ade8a800f827107824495%40%3Cjira.kafka.apache.org%3E) (lists.apache.org) mailing-list - [\[tika-dev\] 20200106 \[jira\] \[Commented\] (TIKA-3019) \[9.8\] \[CVE-2019-17571\] \[tika-app\] \[1.23\]](https://lists.apache.org/thread.html/rf2567488cfc9212b42e34c6393cfa1c14e30e4838b98dda84d71041f%40%3Cdev.tika.apache.org%3E) (lists.apache.org) mailing-list - [\[kafka-jira\] 20200107 \[jira\] \[Updated\] (KAFKA-9366) please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571](https://lists.apache.org/thread.html/r8a1cfd4705258c106e488091fcec85f194c82f2bbde6bd151e201870%40%3Cjira.kafka.apache.org%3E) (lists.apache.org) mailing-list - [\[zookeeper-issues\] 20200107 \[jira\] \[Created\] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer](https://lists.apache.org/thread.html/r944183c871594fe9a555b8519a7c945bbcf6714d72461aa6c929028f%40%3Cissues.zookeeper.apache.org%3E) (lists.apache.org) mailing-list - [\[zookeeper-dev\] 20200107 \[jira\] \[Created\] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer](https://lists.apache.org/thread.html/rbdf18e39428b5c80fc35113470198b1fe53b287a76a46b0f8780b5fd%40%3Cdev.zookeeper.apache.org%3E) (lists.apache.org) mailing-list - [\[zookeeper-issues\] 20200107 \[jira\] \[Commented\] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer](https://lists.apache.org/thread.html/r05755112a8c164abc1004bb44f198b1e3d8ca3d546a8f13ebd3aa05f%40%3Cissues.zookeeper.apache.org%3E) (lists.apache.org) mailing-list - [\[tika-dev\] 20200107 \[jira\] \[Commented\] (TIKA-3019) \[9.8\] \[CVE-2019-17571\] \[tika-app\] \[1.23\]](https://lists.apache.org/thread.html/r3a85514a518f3080ab1fc2652cfe122c2ccf67cfb32356acb1b08fe8%40%3Cdev.tika.apache.org%3E) (lists.apache.org) mailing-list - [\[zookeeper-issues\] 20200108 \[jira\] \[Commented\] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer](https://lists.apache.org/thread.html/r356d57d6225f91fdc30f8b0a2bed229d1ece55e16e552878c5fa809a%40%3Cissues.zookeeper.apache.org%3E) (lists.apache.org) mailing-list - [\[zookeeper-notifications\] 20200108 \[GitHub\] \[zookeeper\] eolivelli opened a new pull request #1209: ZOOKEEPER-3677 owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer](https://lists.apache.org/thread.html/rf1b434e11834a4449cd7addb69ed0aef0923112b5938182b363a968c%40%3Cnotifications.zookeeper.apache.org%3E) (lists.apache.org) mailing-list - [\[zookeeper-issues\] 20200108 \[jira\] \[Updated\] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer](https://lists.apache.org/thread.html/rc628307962ae1b8cc2d21b8e4b7dd6d7755b2dd52fa56a151a27e4fd%40%3Cissues.zookeeper.apache.org%3E) (lists.apache.org) mailing-list - [\[zookeeper-issues\] 20200108 \[jira\] \[Assigned\] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer](https://lists.apache.org/thread.html/r6aec6b8f70167fa325fb98b3b5c9ce0ffaed026e697b69b85ac24628%40%3Cissues.zookeeper.apache.org%3E) (lists.apache.org) mailing-list - [\[tika-dev\] 20200108 \[jira\] \[Commented\] (TIKA-3019) \[9.8\] \[CVE-2019-17571\] \[tika-app\] \[1.23\]](https://lists.apache.org/thread.html/rc1eaed7f7d774d5d02f66e49baced31e04827a1293d61a70bd003ca7%40%3Cdev.tika.apache.org%3E) (lists.apache.org) mailing-list - [\[tika-dev\] 20200110 \[jira\] \[Commented\] (TIKA-3019) \[9.8\] \[CVE-2019-17571\] \[tika-app\] \[1.23\]](https://lists.apache.org/thread.html/r681b4432d0605f327b68b9f8a42662993e699d04614de4851c35ffd1%40%3Cdev.tika.apache.org%3E) (lists.apache.org) mailing-list - [\[tika-dev\] 20200111 Re: \[jira\] \[Commented\] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571](https://lists.apache.org/thread.html/ra38785cfc0e7f17f8e24bebf775dd032c033fadcaea29e5bc9fffc60%40%3Cdev.tika.apache.org%3E) (lists.apache.org) mailing-list - [\[tika-dev\] 20200111 \[jira\] \[Closed\] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571](https://lists.apache.org/thread.html/r746fbc3fc13aee292ae6851f7a5080f592fa3a67b983c6887cdb1fc5%40%3Cdev.tika.apache.org%3E) (lists.apache.org) mailing-list - [\[tika-dev\] 20200111 \[jira\] \[Resolved\] (TIKA-3018) log4j 1.2 version used by Apache Tika 1.23 is vulnerable to CVE-2019-17571](https://lists.apache.org/thread.html/rdec0d8ac1f03e6905b0de2df1d5fcdb98b94556e4f6cccf7519fdb26%40%3Cdev.tika.apache.org%3E) (lists.apache.org) mailing-list - [\[debian-lts-announce\] 20200112 \[SECURITY\] \[DLA 2065-1\] apache-log4j1.2 security update](https://lists.debian.org/debian-lts-announce/2020/01/msg00008.html) (lists.debian.org) mailing-list - [openSUSE-SU-2020:0051](http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00022.html) (lists.opensuse.org) vendor-advisory - [\[tika-dev\] 20200114 \[jira\] \[Commented\] (TIKA-3019) \[9.8\] \[CVE-2019-17571\] \[tika-app\] \[1.23\]](https://lists.apache.org/thread.html/rca24a281000fb681d7e26e5c031a21eb4b0593a7735f781b53dae4e2%40%3Cdev.tika.apache.org%3E) (lists.apache.org) mailing-list - [\[tika-dev\] 20200115 \[jira\] \[Commented\] (TIKA-3019) \[9.8\] \[CVE-2019-17571\] \[tika-app\] \[1.23\]](https://lists.apache.org/thread.html/r4b25538be50126194cc646836c718b1a4d8f71bd9c912af5b59134ad%40%3Cdev.tika.apache.org%3E) (lists.apache.org) mailing-list - [\[zookeeper-commits\] 20200118 \[zookeeper\] branch branch-3.5 updated: ZOOKEEPER-3677: owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer](https://lists.apache.org/thread.html/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573%40%3Ccommits.zookeeper.apache.org%3E) (lists.apache.org) mailing-list - [\[zookeeper-dev\] 20200118 Build failed in Jenkins: zookeeper-master-maven-owasp #329](https://lists.apache.org/thread.html/r107c8737db39ec9ec4f4e7147b249e29be79170b9ef4b80528105a2d%40%3Cdev.zookeeper.apache.org%3E) (lists.apache.org) mailing-list - [\[zookeeper-commits\] 20200118 \[zookeeper\] branch master updated: ZOOKEEPER-3677: owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer](https://lists.apache.org/thread.html/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177%40%3Ccommits.zookeeper.apache.org%3E) (lists.apache.org) mailing-list - [\[zookeeper-notifications\] 20200118 \[GitHub\] \[zookeeper\] asfgit closed pull request #1209: ZOOKEEPER-3677 owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer](https://lists.apache.org/thread.html/rc17d8491beee51607693019857e41e769795366b85be00aa2f4b3159%40%3Cnotifications.zookeeper.apache.org%3E) (lists.apache.org) mailing-list - [\[zookeeper-commits\] 20200118 \[zookeeper\] branch branch-3.6 updated: ZOOKEEPER-3677: owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer](https://lists.apache.org/thread.html/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8%40%3Ccommits.zookeeper.apache.org%3E) (lists.apache.org) mailing-list - [\[zookeeper-issues\] 20200118 \[jira\] \[Resolved\] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer](https://lists.apache.org/thread.html/rd6254837403e8cbfc7018baa9be29705f3f06bd007c83708f9a97679%40%3Cissues.zookeeper.apache.org%3E) (lists.apache.org) mailing-list - [\[activemq-issues\] 20200122 \[jira\] \[Updated\] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571](https://lists.apache.org/thread.html/rd5dbeee4808c0f2b9b51479b50de3cc6adb1072c332a200d9107f13e%40%3Cissues.activemq.apache.org%3E) (lists.apache.org) mailing-list - [\[activemq-issues\] 20200122 \[jira\] \[Assigned\] (AMQ-7372) \[9.8\] \[CVE-2019-17571\] \[activemq-all\] \[5.15.10\]](https://lists.apache.org/thread.html/r7bcdc710857725c311b856c0b82cee6207178af5dcde1bd43d289826%40%3Cissues.activemq.apache.org%3E) (lists.apache.org) mailing-list - [\[activemq-issues\] 20200122 \[jira\] \[Updated\] (AMQ-7372) \[9.8\] \[CVE-2019-17571\] \[activemq-all\] \[5.15.10\]](https://lists.apache.org/thread.html/raedd12dc24412b3780432bf202a2618a21a727788543e5337a458ead%40%3Cissues.activemq.apache.org%3E) (lists.apache.org) mailing-list - [\[activemq-issues\] 20200122 \[jira\] \[Assigned\] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571](https://lists.apache.org/thread.html/r2ff63f210842a3c5e42f03a35d8f3a345134d073c80a04077341c211%40%3Cissues.activemq.apache.org%3E) (lists.apache.org) mailing-list - [\[activemq-issues\] 20200122 \[jira\] \[Resolved\] (AMQ-7372) \[9.8\] \[CVE-2019-17571\] \[activemq-all\] \[5.15.10\]](https://lists.apache.org/thread.html/r3d666e4e8905157f3c046d31398b04f2bfd4519e31f266de108c6919%40%3Cissues.activemq.apache.org%3E) (lists.apache.org) mailing-list - [\[activemq-issues\] 20200127 \[jira\] \[Commented\] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571](https://lists.apache.org/thread.html/r61590890edcc64140e0c606954b29a063c3d08a2b41d447256d51a78%40%3Cissues.activemq.apache.org%3E) (lists.apache.org) mailing-list - [\[zookeeper-issues\] 20200129 \[jira\] \[Updated\] (ZOOKEEPER-3677) owasp checker failing for - CVE-2019-17571 Apache Log4j 1.2 deserialization of untrusted data in SocketServer](https://lists.apache.org/thread.html/r909b8e3a36913944d3b7bafe9635d4ca84f8f0e2cd146a1784f667c2%40%3Cissues.zookeeper.apache.org%3E) (lists.apache.org) mailing-list - [\[zookeeper-user\] 20200201 Re: Zookeeper 3.5.6 supports log4j 2.x?](https://lists.apache.org/thread.html/r4ac89cbecd9e298ae9fafb5afda6fa77ac75c78d1ac957837e066c4e%40%3Cuser.zookeeper.apache.org%3E) (lists.apache.org) mailing-list - [\[activemq-issues\] 20200208 \[jira\] \[Commented\] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571](https://lists.apache.org/thread.html/r2ce8d26154bea939536e6cf27ed02d3192bf5c5d04df885a80fe89b3%40%3Cissues.activemq.apache.org%3E) (lists.apache.org) mailing-list - [\[logging-log4j-user\] 20200224 Apache Log4j - Migration activity to 2.12.1 version - Request to support for the queries posted](https://lists.apache.org/thread.html/r6236b5f8646d48af8b66d5050f288304016840788e508c883356fe0e%40%3Clog4j-user.logging.apache.org%3E) (lists.apache.org) mailing-list - [\[activemq-issues\] 20200228 \[jira\] \[Commented\] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571](https://lists.apache.org/thread.html/re8c21ed9dd218c217d242ffa90778428e446b082b5e1c29f567e8374%40%3Cissues.activemq.apache.org%3E) (lists.apache.org) mailing-list - [\[activemq-issues\] 20200228 \[jira\] \[Resolved\] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571](https://lists.apache.org/thread.html/rb1b29aee737e1c37fe1d48528cb0febac4f5deed51f5412e6fdfe2bf%40%3Cissues.activemq.apache.org%3E) (lists.apache.org) mailing-list - [\[activemq-issues\] 20200228 \[jira\] \[Updated\] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571](https://lists.apache.org/thread.html/r18f1c010b554a3a2d761e8ffffd8674fd4747bcbcf16c643d708318c%40%3Cissues.activemq.apache.org%3E) (lists.apache.org) mailing-list - [\[jena-dev\] 20200318 Re: Logging (JENA-1005)](https://lists.apache.org/thread.html/r8d78a0fbb56d505461e29868d1026e98c402e6a568c13a6da67896a2%40%3Cdev.jena.apache.org%3E) (lists.apache.org) mailing-list - [\[druid-commits\] 20200406 \[GitHub\] \[druid\] ccaominh commented on issue #9579: Add Apache Ranger Authorization](https://lists.apache.org/thread.html/r8890b8f18f1de821595792b58b968a89692a255bc20d86d395270740%40%3Ccommits.druid.apache.org%3E) (lists.apache.org) mailing-list - [\[zookeeper-commits\] 20200504 \[zookeeper\] branch master updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488](https://lists.apache.org/thread.html/rbc45eb0f53fd6242af3e666c2189464f848a851d408289840cecc6e3%40%3Ccommits.zookeeper.apache.org%3E) (lists.apache.org) mailing-list - [\[zookeeper-commits\] 20200504 \[zookeeper\] branch branch-3.5 updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488](https://lists.apache.org/thread.html/rec34b1cccf907898e7cb36051ffac3ccf1ea89d0b261a2a3b3fb267f%40%3Ccommits.zookeeper.apache.org%3E) (lists.apache.org) mailing-list - [\[zookeeper-commits\] 20200504 \[zookeeper\] branch branch-3.6 updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488](https://lists.apache.org/thread.html/r48efc7cb5aeb4e1f67aaa06fb4b5479a5635d12f07d0b93fc2d08809%40%3Ccommits.zookeeper.apache.org%3E) (lists.apache.org) mailing-list - [\[kafka-jira\] 20200514 \[GitHub\] \[kafka\] jeffhuang26 commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571](https://lists.apache.org/thread.html/r696507338dd5f44efc23d98cafe30f217cf3ba78e77ed1324c7a5179%40%3Cjira.kafka.apache.org%3E) (lists.apache.org) mailing-list - [DSA-4686](https://www.debian.org/security/2020/dsa-4686) (debian.org) vendor-advisory - [\[kafka-jira\] 20200529 \[GitHub\] \[kafka\] ijuma commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571](https://lists.apache.org/thread.html/rf9c19bcc2f7a98a880fa3e3456c003d331812b55836b34ef648063c9%40%3Cjira.kafka.apache.org%3E) (lists.apache.org) mailing-list - [\[kafka-jira\] 20200602 \[GitHub\] \[kafka\] dongjinleekr commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571](https://lists.apache.org/thread.html/r71e26f9c2d5826c6f95ad60f7d052d75e1e70b0d2dd853db6fc26d5f%40%3Cjira.kafka.apache.org%3E) (lists.apache.org) mailing-list - [oracle.com/security-alerts/cpuapr2020.html](https://www.oracle.com/security-alerts/cpuapr2020.html) - [\[kafka-jira\] 20200624 \[GitHub\] \[kafka\] dongjinleekr commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571](https://lists.apache.org/thread.html/r7f462c69d5ded4c0223e014d95a3496690423c5f6f05c09e2f2a407a%40%3Cjira.kafka.apache.org%3E) (lists.apache.org) mailing-list - [\[kafka-jira\] 20200625 \[GitHub\] \[kafka\] dongjinleekr commented on pull request #7898: KAFKA-9366: please consider upgrade log4j to log4j2 due to critical security problem CVE-2019-17571](https://lists.apache.org/thread.html/r7a1acc95373105169bd44df710c2f462cad31fb805364d2958a5ee03%40%3Cjira.kafka.apache.org%3E) (lists.apache.org) mailing-list - [oracle.com/security-alerts/cpujul2020.html](https://www.oracle.com/security-alerts/cpujul2020.html) - [lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1d…](https://lists.apache.org/thread.html/eea03d504b36e8f870e8321d908e1def1addda16adda04327fe7c125%40%3Cdev.logging.apache.org%3E) - [security.netapp.com/advisory/ntap-20200110-0001](https://security.netapp.com/advisory/ntap-20200110-0001/) - [\[bookkeeper-issues\] 20200729 \[GitHub\] \[bookkeeper\] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image](https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E) (lists.apache.org) mailing-list - [\[activemq-issues\] 20200730 \[jira\] \[Commented\] (AMQ-7370) log4j 1.2 version used by AMQ 5.15.10 / 5.15.11 is vulnerable to CVE-2019-17571](https://lists.apache.org/thread.html/r3784834e80df2f284577a5596340fb84346c91a2dea6a073e65e3397%40%3Cissues.activemq.apache.org%3E) (lists.apache.org) mailing-list - [\[hadoop-common-issues\] 20200824 \[jira\] \[Commented\] (HADOOP-17221) Upgrade log4j-1.2.17 to atlassian ( To Adress: CVE-2019-17571)](https://lists.apache.org/thread.html/r6b45a2fcc8e98ac93a179183dbb7f340027bdb8e3ab393418076b153%40%3Ccommon-issues.hadoop.apache.org%3E) (lists.apache.org) mailing-list - [\[hadoop-common-issues\] 20200824 \[jira\] \[Comment Edited\] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Adress: CVE-2019-17571)](https://lists.apache.org/thread.html/r8c6300245c0bcef095e9f07b48157e2c6471df0816db3408fcf1d748%40%3Ccommon-issues.hadoop.apache.org%3E) (lists.apache.org) mailing-list - [\[hadoop-common-issues\] 20200824 \[jira\] \[Updated\] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)](https://lists.apache.org/thread.html/rd7805c1bf9388968508c6c8f84588773216e560055ddcc813d19f347%40%3Ccommon-issues.hadoop.apache.org%3E) (lists.apache.org) mailing-list - [\[hadoop-common-issues\] 20200824 \[jira\] \[Assigned\] (HADOOP-17221) Upgrade log4j-1.2.17 to atlassian ( To Adress: CVE-2019-17571)](https://lists.apache.org/thread.html/r26244f9f7d9a8a27a092eb0b2a0ca9395e88fcde8b5edaeca7ce569c%40%3Ccommon-issues.hadoop.apache.org%3E) (lists.apache.org) mailing-list - [\[hadoop-common-dev\] 20200824 \[jira\] \[Created\] (HADOOP-17221) Upgrade log4j-1.2.17 to atlassian ( To Adress: CVE-2019-17571)](https://lists.apache.org/thread.html/rbd19de368abf0764e4383ec44d527bc9870176f488a494f09a40500d%40%3Ccommon-dev.hadoop.apache.org%3E) (lists.apache.org) mailing-list - [\[hadoop-common-issues\] 20200824 \[jira\] \[Updated\] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Adress: CVE-2019-17571)](https://lists.apache.org/thread.html/r1b7734dfdfd938640f2f5fb6f4231a267145c71ed60cc7faa1cbac07%40%3Ccommon-issues.hadoop.apache.org%3E) (lists.apache.org) mailing-list - [\[hadoop-common-issues\] 20200824 \[jira\] \[Created\] (HADOOP-17221) Upgrade log4j-1.2.17 to atlassian ( To Adress: CVE-2019-17571)](https://lists.apache.org/thread.html/r13d4b5c60ff63f3c4fab51d6ff266655be503b8a1884e2f2fab67c3a%40%3Ccommon-issues.hadoop.apache.org%3E) (lists.apache.org) mailing-list - [\[hadoop-common-issues\] 20200824 \[jira\] \[Commented\] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)](https://lists.apache.org/thread.html/r8c392ca48bb7e50754e4bc05865e9731b23d568d18a520fe3d8c1f75%40%3Ccommon-issues.hadoop.apache.org%3E) (lists.apache.org) mailing-list - [\[hadoop-common-issues\] 20200824 \[jira\] \[Comment Edited\] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)](https://lists.apache.org/thread.html/r9fb3238cfc3222f2392ca6517353aadae18f76866157318ac562e706%40%3Ccommon-issues.hadoop.apache.org%3E) (lists.apache.org) mailing-list - [USN-4495-1](https://usn.ubuntu.com/4495-1/) (usn.ubuntu.com) vendor-advisory - [\[zookeeper-dev\] 20201103 \[jira\] \[Created\] (ZOOKEEPER-3990) Log4j 1.2.17 used by zookeeper 3.6.1 is vulnerable to CVE-2019-17571](https://lists.apache.org/thread.html/ra54fa49be3e773d99ccc9c2a422311cf77e3ecd3b8594ee93043a6b1%40%3Cdev.zookeeper.apache.org%3E) (lists.apache.org) mailing-list - [\[zookeeper-issues\] 20201103 \[jira\] \[Created\] (ZOOKEEPER-3990) Log4j 1.2.17 used by zookeeper 3.6.1 is vulnerable to CVE-2019-17571](https://lists.apache.org/thread.html/r9d0d03f2e7d9e13c68b530f81d02b0fec33133edcf27330d8089fcfb%40%3Cissues.zookeeper.apache.org%3E) (lists.apache.org) mailing-list - [\[zookeeper-issues\] 20201103 \[jira\] \[Resolved\] (ZOOKEEPER-3990) Log4j 1.2.17 used by zookeeper 3.6.1 is vulnerable to CVE-2019-17571](https://lists.apache.org/thread.html/r3cf50d05ce8cec8c09392624b7bae750e7643dae60ef2438641ee015%40%3Cissues.zookeeper.apache.org%3E) (lists.apache.org) mailing-list - [\[pulsar-commits\] 20201215 \[GitHub\] \[pulsar\] yanshuchong opened a new issue #8967: CVSS issue list](https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E) (lists.apache.org) mailing-list - [\[kafka-users\] 20210210 Security: CVE-2019-17571 (log4j)](https://lists.apache.org/thread.html/rda4849c6823dd3e83c7a356eb883180811d5c28359fe46865fd151c3%40%3Cusers.kafka.apache.org%3E) (lists.apache.org) mailing-list - [\[kafka-jira\] 20210211 \[GitHub\] \[kafka\] ch4rl353y commented on pull request #7898: KAFKA-9366: Change log4j dependency into log4j2](https://lists.apache.org/thread.html/r5c084578b3e3b40bd903c9d9e525097421bcd88178e672f612102eb2%40%3Cjira.kafka.apache.org%3E) (lists.apache.org) mailing-list - [\[mina-dev\] 20210225 \[jira\] \[Created\] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar](https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E) (lists.apache.org) mailing-list - [\[tinkerpop-dev\] 20210316 \[jira\] \[Created\] (TINKERPOP-2534) Log4j flagged as critical security violation](https://lists.apache.org/thread.html/rd3a9511eebab60e23f224841390a3f8cd5358cff605c5f7042171e47%40%3Cdev.tinkerpop.apache.org%3E) (lists.apache.org) mailing-list - [\[activemq-users\] 20210427 Release date for ActiveMQ v5.16.2 to fix CVEs](https://lists.apache.org/thread.html/r8244fd0831db894d5e89911ded9c72196d395a90ae655414d23ed0dd%40%3Cusers.activemq.apache.org%3E) (lists.apache.org) mailing-list - [\[activemq-users\] 20210427 Re: Release date for ActiveMQ v5.16.2 to fix CVEs](https://lists.apache.org/thread.html/r3543ead2317dcd3306f69ee37b07dd383dbba6e2f47ff11eb55879ad%40%3Cusers.activemq.apache.org%3E) (lists.apache.org) mailing-list - [\[kafka-dev\] 20210611 Re: \[DISCUSS\] KIP-719: Add Log4J2 Appender](https://lists.apache.org/thread.html/r3bf7b982dfa0779f8a71f843d2aa6b4184a53e6be7f149ee079387fd%40%3Cdev.kafka.apache.org%3E) (lists.apache.org) mailing-list - [oracle.com/security-alerts/cpuApr2021.html](https://www.oracle.com/security-alerts/cpuApr2021.html) - [\[kafka-users\] 20210617 vulnerabilities](https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe%40%3Cusers.kafka.apache.org%3E) (lists.apache.org) mailing-list - [\[portals-pluto-scm\] 20210629 \[portals-pluto\] branch master updated: PLUTO-787 Migrate from Log4j 1.x to Log4j 2.x due to CVE-2019-17571](https://lists.apache.org/thread.html/reaf6b996f74f12b4557bc221abe88f58270ac583942fa41293c61f94%40%3Cpluto-scm.portals.apache.org%3E) (lists.apache.org) mailing-list - [\[portals-pluto-dev\] 20210629 \[jira\] \[Closed\] (PLUTO-787) Migrate from Log4j 1.x to Log4j 2.x due to CVE-2019-17571](https://lists.apache.org/thread.html/r9a9e3b42cd5d1c4536a14ef04f75048dec8e2740ac6a138ea912177f%40%3Cpluto-dev.portals.apache.org%3E) (lists.apache.org) mailing-list - [\[portals-pluto-dev\] 20210629 \[jira\] \[Updated\] (PLUTO-787) Migrate from Log4j 1.x to Log4j 2.x due to CVE-2019-17571](https://lists.apache.org/thread.html/rd882ab6b642fe59cbbe94dc02bd197342058208f482e57b537940a4b%40%3Cpluto-dev.portals.apache.org%3E) (lists.apache.org) mailing-list - [\[portals-pluto-dev\] 20210629 \[jira\] \[Updated\] (PLUTO-787) Migrate from Log4J and SLF4J dependencies due to CVE-2019-17571](https://lists.apache.org/thread.html/rf77f79699c8d7e430c14cf480f12ed1297e6e8cf2ed379a425941e80%40%3Cpluto-dev.portals.apache.org%3E) (lists.apache.org) mailing-list - [\[activemq-users\] 20210830 Security issues](https://lists.apache.org/thread.html/r9dc2505651788ac668299774d9e7af4dc616be2f56fdc684d1170882%40%3Cusers.activemq.apache.org%3E) (lists.apache.org) mailing-list - [\[activemq-users\] 20210831 RE: Security issues](https://lists.apache.org/thread.html/r52a5129df402352adc34d052bab9234c8ef63596306506a89fdc7328%40%3Cusers.activemq.apache.org%3E) (lists.apache.org) mailing-list - [\[kafka-dev\] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image](https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E) (lists.apache.org) mailing-list - [\[kafka-users\] 20210831 Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image](https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E) (lists.apache.org) mailing-list - [\[kafka-users\] 20210901 Re: \[EXTERNAL\] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image](https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E) (lists.apache.org) mailing-list - [\[kafka-dev\] 20210901 Re: \[EXTERNAL\] Re: Security vulnerabilities in kafka:2.13-2.6.0/2.7.0 docker image](https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E) (lists.apache.org) mailing-list - [\[hadoop-common-issues\] 20211006 \[jira\] \[Commented\] (HADOOP-17221) update log4j-1.2.17 to atlassian version( To Address: CVE-2019-17571)](https://lists.apache.org/thread.html/r9d2e28e71f91ba0b6f4114c8ecd96e2b1f7e0d06bdf8eb768c183aa9%40%3Ccommon-issues.hadoop.apache.org%3E) (lists.apache.org) mailing-list - [\[bookkeeper-issues\] 20211006 \[GitHub\] \[bookkeeper\] RaulGracia opened a new issue #2815: Upgrade to log4j2 to get rid of CVE-2019-17571](https://lists.apache.org/thread.html/re36da78e4f3955ba6c1c373a2ab85a4deb215ca74b85fcd66142fea1%40%3Cissues.bookkeeper.apache.org%3E) (lists.apache.org) mailing-list and 13 more in the [record on cve.org](https://www.cve.org/CVERecord?id=CVE-2019-17571) ## Timeline 1. ID reserved Oct 14, 2019 2. Record published Dec 20, 2019 3. Record last updated May 28, 2026 ## Look up another CVE ## About CubePath CubePath is a cloud provider with data centers in Europe and the United States. It offers VPS, bare metal servers and DDoS protection. [Cloud VPS](https://cubepath.com/vps) [DDoS protection](https://cubepath.com/ddos-protection) Data from the CVE Program (MITRE), CISA KEV and FIRST EPSS. CVSS is owned by FIRST and used by permission. Not affiliated with or endorsed by MITRE, CISA or FIRST. Data as of Nov 10, 2026, 20:02 UTC. [Sources and licenses](https://cubepath.com/security/cve/legal)