{"data":{"cve":"CVE-2021-44228","in_kev":true,"kev":{"cve":"CVE-2021-44228","in_kev":true,"vendor":"Apache","product":"Log4j2","name":"Apache Log4j2 Remote Code Execution Vulnerability","date_added":"2021-12-10","due_date":"2021-12-24","required_action":"For all affected software assets for which updates exist, the only acceptable remediation actions are: 1) Apply updates; OR 2) remove affected assets from agency networks. Temporary mitigations using one of the measures provided at https://www.cisa.gov/uscert/ed-22-02-apache-log4j-recommended-mitigation-measures are only acceptable until updates are available.","known_ransomware":true,"notes_urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-44228"]},"kev_catalog_version":"2026.10.16","cvss":10,"priority":"critical","priority_basis":"kev","priority_rule":"critical: in CISA KEV; null: not in CISA KEV (see priority_basis), or KEV not checked","advisory_count":1,"advisories":[{"id":"GHSA-jfh8-c2jp-5v3q","kind":"vuln","ecosystem":"Maven","aliases":["CVE-2021-44228"],"summary":"Remote code injection in Log4j","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H"}],"severity_label":"CRITICAL","published":"2021-12-10T00:40:56Z","modified":"2025-10-22T19:37:02.616807Z","affected":[{"name":"org.apache.logging.log4j:log4j-core","purl":"pkg:maven/org.apache.logging.log4j/log4j-core","fixed":["2.3.1","2.12.2","2.15.0"]},{"name":"com.guicedee.services:log4j-core","purl":"pkg:maven/com.guicedee.services/log4j-core","fixed":[]},{"name":"org.xbib.elasticsearch:log4j","purl":"pkg:maven/org.xbib.elasticsearch/log4j","fixed":[]},{"name":"uk.co.nichesolutions.logging.log4j:log4j-core","purl":"pkg:maven/uk.co.nichesolutions.logging.log4j/log4j-core","fixed":[]},{"name":"org.ops4j.pax.logging:pax-logging-log4j2","purl":"pkg:maven/org.ops4j.pax.logging/pax-logging-log4j2","fixed":["1.9.2","1.10.8","1.11.10","2.0.11"]}],"sources":[{"id":"GHSA-jfh8-c2jp-5v3q","prefix":"GHSA","name":"GitHub Advisory Database","licence":"CC-BY-4.0","licence_url":"https://creativecommons.org/licenses/by/4.0/","url":"https://github.com/advisories/GHSA-jfh8-c2jp-5v3q"}]}]},"meta":{"dataset":"cve","datasets":{"osv":{"dataset":"osv","snapshot_id":"osv-2026-10-16T21:43:31.456Z","as_of":"2026-10-16T21:43:31.456Z","retrieved_at":"2026-10-16T21:43:25.384Z","age_hours":1.7,"cadence_hours":6,"stale_at":"2026-10-17T09:43:25.385Z","stale":false,"source":"https://osv.dev/","attribution":"Vulnerability data from OSV.dev and the upstream databases listed, under their licences; joined and reformatted by Stack Facts (records are modified: fields trimmed and reshaped).","licence_url":"/licences","ecosystems":{"Go":{"imported_at":"2026-10-16T21:43:30.407Z","checked_at":"2026-10-16T21:43:30.407Z","records":9484,"sha256":"a356e620ad1512ca7bb554ad0540e0ecde595c0b766548fed0e49802c785a942"},"Maven":{"imported_at":"2026-10-16T21:43:28.846Z","checked_at":"2026-10-16T21:43:28.846Z","records":7079,"sha256":"e42fa0da27e90b0070fb9807996aa186dab44384ebf1bfb61d69a7c247110f6b"},"PyPI":{"imported_at":"2026-10-16T21:43:27.463Z","checked_at":"2026-10-16T21:43:27.463Z","records":25753,"sha256":"458913bec3fccc4bc18455ddefe70ef71e69607880ee2b028caf70416fb6717c"},"crates.io":{"imported_at":"2026-10-16T21:43:31.456Z","checked_at":"2026-10-16T21:43:31.456Z","records":2811,"sha256":"c5320e322bbdf96a12e71413267482429bf0e44fa65731d5d24c8c2f411f6172"},"npm":{"imported_at":"2026-10-16T21:43:25.384Z","checked_at":"2026-10-16T21:43:25.384Z","records":229650,"sha256":"c3ae2ef2bd2a80ec2b10c869c8b698c9f39dad2a4a4fdc33bf510cfb2af0ac79"}},"notice":"Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source."},"kev":{"dataset":"kev","snapshot_id":"kev-20261016T204226Z-6260e5f8","as_of":"2026-10-16T20:42:26Z","retrieved_at":"2026-10-16T20:42:26.000Z","source":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","licence":"CC0-1.0","attribution":"Source: CISA Known Exploited Vulnerabilities Catalog (CC0 1.0). Not endorsed by CISA or DHS.","sha256":"6260e5f8a11a89bcd2181e175cfd9987196f22d6d6a9ef05ec08774adb760c50","signature":"Pucf1Flo6XZjuIOf5FUEGBYSQH1ZB2gepIOnCXTI3NcVK9jlCgROSnlbRMKVrI5Vn5Mg4dxZwT-tuXejTFioBQ","key_id":"sf-2026-10","manifest_url":"/v1/kev/manifest","stale":false,"notice":"Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source."}},"attribution":"KEV status from the CISA Known Exploited Vulnerabilities Catalog. CVSS base scores computed by us from the CVSS v3 vectors in the OSV advisories we hold (see /licences).","licences":"/licences","stale":false,"notice":"Normalised (modified) from the source. Provided as is, without warranty. Not endorsed by the source.","sample":true,"next":"GET /v1/cve/{id} returns this shape for any CVE (paid, $0.003); GET /v1/try/cve is CVE-2021-44228 only (free)"}}