CVE-2019-17571 Log4j
| Affected software | Log4j |
|---|---|
| Severity | 9.8 Critical CVSS 3.1 3 scores |
| Weakness | Deserialization of untrusted data (CWE-502) |
| Published | 20 Dec 2019 |
| Updated | 13 Nov 2026 |
Description
Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.
Exploitation status
Proof of concept only
A proof of concept exists, but no reviewed exploit catalogue lists this CVE.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC 3 indexed Published artifacts you can open, in GitHub PoC; first seen 2019-12-25.
- EPSS 70% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99% of all scored CVEs.
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | Apache Log4j 1.2.X存在反序列化远程代码执行漏洞 | 78 | 2019-12-25 |
| GitHub PoC | Fastest filesystem scanner for log4shell (CVE-2021-44228, CVE-2021-45046) and other vulnerable (CVE-2017-5645, CVE-2019-17571, CVE-2022-23305, CVE-2022-23307 ... ) instances of log4j library. Excellent performance and low memory footprint. | 39 | 2021-12-14 |
| GitHub PoC | Environment for CVE_2019_17571 | 1 | 2020-07-16 |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Deserialization, Process
- Action available patch rule
- Review human ARMR file
- Record active
| Decided by | An ARMR patch file on disk for this CVE |
|---|---|
| Finding | CVE has an ARMR patch rule that provides mitigation |
ARMR rule files
1 fileThe rule files Waratek ships for this CVE. Some CVEs need more than one, for example one per affected library or one per ARMR version.
CVE-2019-17571.armr patch rule, ARMR 2.6 added 2021-12-15 updated 2026-03-04Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: ARMR marshal Deserial RCE rule, deserial rule will cover this (and process fork)
- ARMR marshal deserialization rce rule
How to mitigate CVE-2019-17571
Apply the vendor's fix for Log4j. Until you can, Waratek RASP blocks exploitation with a rule written for this CVE. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
9.8 CRITICAL
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
CVSS
9.8 CRITICAL v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CISA-ADP | Secondary | |
| CVSS 2.0 | 7.5 | none | AV:N/AC:L/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update July 2023 ↗ | CPU | 2023-Q3 | Oracle Enterprise Manager / Load Testing for Web Apps (Apache Log4j) (13.3.0.1) |
| Oracle Critical Patch Update January 2023 ↗ | CPU | 2023-Q1 | Oracle Communications Applications / Message Bus (Apache Log4j) (5.5.0-5.5.9, 6.0.0-6.0.1) |
| Oracle Critical Patch Update April 2020 ↗ | CPU | 2020-Q2 | Oracle Fusion Middleware / Console (Apache Log4j) (10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Communications Applications | Message Bus (Apache Log4j) | 5.5.0-5.5.9, 6.0.0-6.0.1 | |
| Oracle Enterprise Manager | Load Testing for Web Apps (Apache Log4j) | 13.3.0.1 | 13.3.0.1 |
| Oracle Fusion Middleware | Console (Apache Log4j) | 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 | 10.3.6.0.0 · 12.1.3.0.0 · 12.2.1.3.0 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
log4j:log4j |
1.2 | none | 1.2.17 |
org.zenframework.z8.dependencies.commons:log4j-1.2.17 |
unspecified | none | unbounded |
Products and versions
19 products, 30 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | apache | bookkeeper | generic | ＜ 4.14.3 |
| nvd | apache | log4j | generic | ≤ 1.2.17 |
| nvd | canonical | ubuntu linux | generic | 18.04 |
| nvd | debian | debian linux | generic | 8.0 · 9.0 · 10.0 |
| osv | log4j | log4j | generic | ≥ 1.2 and ≤ 1.2.17 |
| nvd | netapp | oncommand system manager | generic | ≥ 3.0 and ≤ 3.1.3 |
| nvd | netapp | oncommand workflow automation | generic | any version |
| nvd | opensuse | leap | generic | 15.1 |
| nvd | oracle | application testing suite | generic | 13.3.0.1 |
| nvd | oracle | communications network integrity | generic | ≥ 7.3.2 and ≤ 7.3.6 |
| nvd | oracle | endeca information discovery studio | generic | 3.2.0 |
| nvd | oracle | financial services lending and leasing | generic | 12.5.0 · ≥ 14.1.0 and ≤ 14.8.0 |
| nvd | oracle | mysql enterprise monitor | generic | ≤ 8.0.29 |
| nvd | oracle | primavera gateway | generic | ≥ 16.2 and ≤ 16.2.11 · ≥ 17.12.0 and ≤ 17.12.7 |
| nvd | oracle | rapid planning | generic | 12.1 · 12.2 |
| nvd | oracle | retail extract transform and load | generic | 19.0 |
| nvd | oracle | retail service backbone | generic | 14.1 · 15.0 · 16.0 |
| nvd | oracle | weblogic server | generic | 10.3.6.0.0 · 12.1.3.0.0 · 12.2.1.3.0 · 12.2.1.4.0 · 14.1.1.0.0 |
| osv | org.zenframework.z8.dependencies.commons | log4j-1.2.17 | generic | any version |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** HTTP, CONSOLE (APACHE LOG4J), NO AUTH REMOTE EXPLOIT **Products:** ORACLE WEBLOGIC SERVER, LOG4J, ORACLE FUSION MIDDLEWARE
References
Timeline
Timeline
| Published | 2019-12-20 | By the CVE Program. |
|---|---|---|
| ARMR remediation created | 2021-12-15 | Earliest commit adding this CVE's ARMR patch or security rule. |
| ARMR remediation last updated | 2026-03-04 | Most recent commit touching this CVE's ARMR patch or security rule. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |
| Last VRT activity | 2026-11-13 | Most recent commit touching this CVE's classification, patch or rule file. |