CVE-2021-4104 Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2

High 7.5 Published 14 Dec 2021 Updated 28 May 2026

Exploited in the wild: Not known
Fix: Available

What is CVE-2021-4104?

CVE-2021-4104 is a high-severity vulnerability in Fedoraproject Fedora, published on 14 Dec 2021.

Official description

JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.

Weakness: CWE-502

Which versions are affected by CVE-2021-4104?

4 open source packages ship an affected version, including log4j:log4j and org.zenframework.z8.dependencies.commons:log4j-1.2.17. It affects 46 products.

Package	Affected	Fixed in
`log4j:log4j` Maven	From `1.2.0` to `1.2.17`	None
`log4j:log4j` Maven	From `1.2.0` to `1.2.17`	None
`org.zenframework.z8.dependencies.commons:log4j-1.2.17` Maven	All versions to `2.0`	None
`org.zenframework.z8.dependencies.commons:log4j-1.2.17` Maven	All versions to `2.0`	None

Linux distribution packages (36)

`log4j` Red Hat:enterprise_linux:7::client	All versions	`0:1.2.17-17.el7_4`
`log4j-javadoc` Red Hat:enterprise_linux:7::client	All versions	`0:1.2.17-17.el7_4`
`log4j-manual` Red Hat:enterprise_linux:7::client	All versions	`0:1.2.17-17.el7_4`
`log4j-javadoc` Red Hat:enterprise_linux:7::computenode	All versions	`0:1.2.17-17.el7_4`
`log4j-manual` Red Hat:enterprise_linux:7::computenode	All versions	`0:1.2.17-17.el7_4`
`log4j` Red Hat:enterprise_linux:7::server	All versions	`0:1.2.17-17.el7_4`
`log4j-javadoc` Red Hat:enterprise_linux:7::server	All versions	`0:1.2.17-17.el7_4`
`log4j-manual` Red Hat:enterprise_linux:7::server	All versions	`0:1.2.17-17.el7_4`
`log4j` Red Hat:enterprise_linux:7::workstation	All versions	`0:1.2.17-17.el7_4`
`log4j-javadoc` Red Hat:enterprise_linux:7::workstation	All versions	`0:1.2.17-17.el7_4`
`log4j-manual` Red Hat:enterprise_linux:7::workstation	All versions	`0:1.2.17-17.el7_4`
`log4j` Red Hat:rhel_aus:7.3::server	All versions	`0:1.2.17-16.el7_3`
`log4j-javadoc` Red Hat:rhel_aus:7.3::server	All versions	`0:1.2.17-16.el7_3`
`log4j-manual` Red Hat:rhel_aus:7.3::server	All versions	`0:1.2.17-16.el7_3`
`log4j` Red Hat:rhel_aus:7.4::server	All versions	`0:1.2.17-17.el7_4`
`log4j-javadoc` Red Hat:rhel_aus:7.4::server	All versions	`0:1.2.17-17.el7_4`
`log4j-manual` Red Hat:rhel_aus:7.4::server	All versions	`0:1.2.17-17.el7_4`
`log4j` Red Hat:rhel_aus:7.6::server	All versions	`0:1.2.17-17.el7_4`
`log4j-javadoc` Red Hat:rhel_aus:7.6::server	All versions	`0:1.2.17-17.el7_4`
`log4j-manual` Red Hat:rhel_aus:7.6::server	All versions	`0:1.2.17-17.el7_4`
`log4j` Red Hat:rhel_aus:7.7::server	All versions	`0:1.2.17-17.el7_4`
`log4j-javadoc` Red Hat:rhel_aus:7.7::server	All versions	`0:1.2.17-17.el7_4`
`log4j-manual` Red Hat:rhel_aus:7.7::server	All versions	`0:1.2.17-17.el7_4`
`log4j` Red Hat:rhel_e4s:7.6::server	All versions	`0:1.2.17-17.el7_4`
`log4j-javadoc` Red Hat:rhel_e4s:7.6::server	All versions	`0:1.2.17-17.el7_4`
`log4j-manual` Red Hat:rhel_e4s:7.6::server	All versions	`0:1.2.17-17.el7_4`
`log4j` Red Hat:rhel_e4s:7.7::server	All versions	`0:1.2.17-17.el7_4`
`log4j-javadoc` Red Hat:rhel_e4s:7.7::server	All versions	`0:1.2.17-17.el7_4`
`log4j-manual` Red Hat:rhel_e4s:7.7::server	All versions	`0:1.2.17-17.el7_4`
`log4j` Red Hat:rhel_els:6	All versions	`0:1.2.14-6.5.el6_10`
`log4j-debuginfo` Red Hat:rhel_els:6	All versions	`0:1.2.14-6.5.el6_10`
`log4j-javadoc` Red Hat:rhel_els:6	All versions	`0:1.2.14-6.5.el6_10`
`log4j-manual` Red Hat:rhel_els:6	All versions	`0:1.2.14-6.5.el6_10`
`rh-maven36-log4j12` Red Hat:rhel_software_collections:3::el7	All versions	`0:1.2.17-23.3.el7`
`rh-maven36-log4j12-javadoc` Red Hat:rhel_software_collections:3::el7	All versions	`0:1.2.17-23.3.el7`
`log4j` Red Hat:rhel_tus:7.6::server	All versions	`0:1.2.17-17.el7_4`

Products include Apache Log4j, Fedoraproject Fedora, Oracle Advanced Supply Chain Planning, Oracle Business Intelligence, Oracle Business Process Management Suite, Oracle Communications Eagle Ftp Table Base Retrieval and 40 more.

How do I fix CVE-2021-4104?

Upgrade to a fixed version.

Is CVE-2021-4104 being exploited?

There is no known exploitation of CVE-2021-4104 in the wild and no public exploit code.

Public exploit code: 3 proofs of concept on GitHub.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as CLEANSTART-2026-FS95827, CLSA-2022-1642429303, CLSA-2022-1642429400, CLSA-2026-1787141079, CLSA-2026-1787546974, DEBIAN-CVE-2021-4104 and 23 more.