CVE-2025-68161
Medium · 5.4Apache Log4j does not verify the TLS hostname in its Socket Appender
CVSS
5.4
EPSS
0.8%
Published
Dec 18, 2025
CISA due date
—
The record
The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the [verifyHostName](https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName) configuration attribute or the [log4j2.sslVerifyHostName](https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName) system property is set to true. This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions: * The attacker is able to intercept or redirect network traffic between the client and the log receiver. * The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured). Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue. As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | org.apache.logging.log4j:log4j-core | 2.0-beta9 | 2.25.3 |
| Chainguard | airflow-3-compat | 0 | 3.1.5-r0 |
| Chainguard | airflow-3-iamguarded-compat | 0 | 3.1.5-r0 |
| Chainguard | apache-activemq-artemis | 0 | 2.44.0-r2 |
| Chainguard | apache-activemq-artemis-compat | 0 | 2.44.0-r2 |
| Chainguard | apache-hop | 0 | 2.16.0-r2 |
| Chainguard | apache-hop-fips | 0 | 2.16.0-r2 |
| Chainguard | apache-pulsar | 0 | 4.1.3-r0 |
| Chainguard | apache-pulsar-compat | 0 | 4.1.2-r2 |
| Chainguard | apache-tika-2.9 | 0 | 2.9.4-r7 |
| Chainguard | apache-tika-3.0 | 0 | 3.0.0-r20 |
| Chainguard | apache-tika-3.0-compat | 0 | 3.0.0-r20 |
| Chainguard | apache-tika-3.1 | 0 | 3.1.0-r17 |
| Chainguard | apache-tika-3.1-compat | 0 | 3.1.0-r17 |
| Chainguard | apache-tika-3.2 | 0 | 3.2.3-r2 |
| Chainguard | apache-tika-3.2-compat | 0 | 3.2.3-r2 |
| Chainguard | apache-tika-fips-2.9 | 0 | 2.9.4-r2 |
| Chainguard | apache-tika-fips-2.9-compat | 0 | 2.9.4-r2 |
| Chainguard | apache-tika-fips-3.0 | 0 | 3.0.0-r3 |
| Chainguard | apache-tika-fips-3.0-compat | 0 | 3.0.0-r3 |
| Chainguard | apache-tika-fips-3.1 | 0 | 3.1.0-r3 |
| Chainguard | apache-tika-fips-3.1-compat | 0 | 3.1.0-r3 |
| Chainguard | apache-tika-fips-3.2 | 0 | 3.2.3-r2 |
| Chainguard | apache-tika-fips-3.2-compat | 0 | 3.2.3-r2 |
| Chainguard | camunda-zeebe-8.3 | 0 | 8.3.22-r11 |
| Chainguard | camunda-zeebe-8.3-compat | 0 | 8.3.22-r11 |
| Chainguard | camunda-zeebe-8.4 | 0 | 8.4.21-r10 |
| Chainguard | camunda-zeebe-8.4-compat | 0 | 8.4.21-r10 |
| Chainguard | camunda-zeebe-8.5 | 0 | 8.5.25-r3 |
| Chainguard | camunda-zeebe-8.5-compat | 0 | 8.5.25-r3 |
| Chainguard | camunda-zeebe-8.6 | 0 | 8.6.34-r2 |
| Chainguard | camunda-zeebe-8.6-compat | 0 | 8.6.34-r2 |
| Chainguard | camunda-zeebe-8.7 | 0 | 8.7.21-r2 |
| Chainguard | camunda-zeebe-8.7-compat | 0 | 8.7.21-r2 |
| Chainguard | camunda-zeebe-8.8 | 0 | 8.8.8-r2 |
| Chainguard | camunda-zeebe-8.8-compat | 0 | 8.8.8-r2 |
| Chainguard | celeborn-0.5 | 0 | 0.5.4-r13 |
| Chainguard | celeborn-0.5-compat | 0 | 0.5.4-r13 |
| Chainguard | celeborn-0.6 | 0 | 0.6.2-r3 |
| Chainguard | celeborn-0.6-compat | 0 | 0.6.2-r3 |
| Chainguard | confluent-kafka | 0 | 8.3.0.99-r0 |
| Chainguard | confluent-kafka-jre-bcfips | 0 | 8.3.0.113-r1 |
| Chainguard | druid | 0 | 35.0.1-r2 |
| Chainguard | druid-compat | 0 | 35.0.1-r2 |
| Chainguard | elasticsearch-8.17-config | 0 | 8.17.10-r15 |
| Chainguard | elasticsearch-8.18-config | 0 | 8.18.8-r2 |
| Chainguard | elasticsearch-8.19-config | 0 | 8.19.9-r0 |
| Chainguard | elasticsearch-9.0-config | 0 | 9.0.8-r2 |
| Chainguard | elasticsearch-9.1-config | 0 | 9.1.9-r0 |
| Chainguard | elasticsearch-9.2-config | 0 | 9.2.3-r0 |
| Chainguard | elasticsearch-9.3 | 0 | 9.3.0-r2 |
| Chainguard | elasticsearch-9.3-iamguarded | 0 | 9.3.0-r2 |
| Chainguard | elasticsearch-fips-8.17-config | 0 | 8.17.10-r3 |
| Chainguard | elasticsearch-fips-8.18-config | 0 | 8.18.8-r3 |
| Chainguard | elasticsearch-fips-8.19-config | 0 | 8.19.9-r0 |
| Chainguard | elasticsearch-fips-9.0-config | 0 | 9.0.8-r2 |
| Chainguard | elasticsearch-fips-9.1-config | 0 | 9.1.9-r0 |
| Chainguard | elasticsearch-fips-9.2-config | 0 | 9.2.3-r0 |
| Chainguard | elasticsearch-fips-9.3 | 0 | 9.3.0-r2 |
| Chainguard | flink-1.19 | 0 | 1.19.3-r3 |
| Chainguard | flink-1.19-compat | 0 | 1.19.3-r3 |
| Chainguard | flink-1.20 | 0 | 1.20.3-r1 |
| Chainguard | flink-2.0 | 0 | 2.0.1-r2 |
| Chainguard | flink-2.0-compat | 0 | 2.0.1-r2 |
| Chainguard | flink-2.1 | 0 | 2.1.1-r2 |
| Chainguard | flink-2.1-compat | 0 | 2.1.1-r2 |
| Chainguard | flink-2.2 | 0 | 2.2.0-r1 |
| Chainguard | flink-2.2-compat | 0 | 2.2.0-r1 |
| Chainguard | geoserver-2.27 | 0 | 2.27.4-r1 |
| Chainguard | geoserver-2.27-community | 0 | 2.27.4-r1 |
| Chainguard | geoserver-2.27-docker | 0 | 2.27.4-r1 |
| Chainguard | geoserver-2.28 | 0 | 2.28.1-r3 |
| Chainguard | geoserver-2.28-community | 0 | 2.28.1-r3 |
| Chainguard | geoserver-2.28-docker | 0 | 2.28.1-r3 |
| Chainguard | ghidra | 0 | 12.0-r1 |
| Chainguard | infinispan-15.0 | 0 | 15.0.21-r3 |
| Chainguard | infinispan-15.0-compat | 0 | 15.0.21-r3 |
| Chainguard | infinispan-15.0-images | 0 | 15.0.21-r3 |
| Chainguard | infinispan-15.1 | 0 | 15.1.7-r5 |
| Chainguard | infinispan-15.1-compat | 0 | 15.1.7-r5 |
| Chainguard | infinispan-15.1-images | 0 | 15.1.7-r5 |
| Chainguard | infinispan-15.2 | 0 | 15.2.6-r3 |
| Chainguard | infinispan-15.2-compat | 0 | 15.2.6-r3 |
| Chainguard | infinispan-15.2-images | 0 | 15.2.6-r3 |
| Chainguard | kafka-4.0 | 0 | 4.0.1-r2 |
| Chainguard | kafka-4.1 | 0 | 4.1.1-r1 |
| Chainguard | kafka-bitnami-compat-4.0 | 0 | 4.0.1-r2 |
| Chainguard | kafka-bridge | 0 | 0.33.1-r7 |
| Chainguard | kafka-bridge-compat | 0 | 0.33.1-r7 |
| Chainguard | kafka-bridge-fips | 0 | 0.33.1-r2 |
| Chainguard | kafka-bridge-fips-compat | 0 | 0.33.1-r2 |
| Chainguard | kafka-iamguarded-compat-4.0 | 0 | 4.0.1-r2 |
| Chainguard | kafka-iamguarded-compat-4.1 | 0 | 4.1.1-r1 |
| Chainguard | kafka-strimzi-compat | 0 | 0.49.1-r2 |
| Chainguard | kafka_exporter-strimzi-compat | 0 | 0.49.1-r2 |
| Chainguard | kserve-modelmesh | 0 | 0.12.0-r20 |
| Chainguard | kserve-modelmesh-compat | 0 | 0.12.0-r20 |
| Chainguard | logstash-8.17-compat | 0 | 8.17.10-r7 |
| Chainguard | logstash-8.17-env2yaml | 0 | 8.17.10-r6 |
| Chainguard | logstash-8.18-compat | 0 | 8.18.8-r4 |
| Chainguard | logstash-8.18-env2yaml | 0 | 8.18.8-r4 |
| Chainguard | logstash-8.19-compat | 0 | 8.19.8-r2 |
| Chainguard | logstash-8.19-env2yaml | 0 | 8.19.8-r2 |
| Chainguard | logstash-9.0-compat | 0 | 9.0.8-r5 |
| Chainguard | logstash-9.0-env2yaml | 0 | 9.0.8-r6 |
| Chainguard | logstash-9.1-compat | 0 | 9.1.8-r2 |
| Chainguard | logstash-9.1-env2yaml | 0 | 9.1.8-r2 |
| Chainguard | logstash-9.2 | 0 | 9.2.7-r0 |
| Chainguard | logstash-9.2-compat | 0 | 9.2.2-r1 |
| Chainguard | logstash-9.2-env2yaml | 0 | 9.2.2-r1 |
| Chainguard | logstash-9.2-iamguarded-compat | 0 | 9.2.7-r0 |
| Chainguard | logstash-9.2-with-output-opensearch | 0 | 9.2.7-r0 |
| Chainguard | neo4j-2025.05 | 0 | 2025.05.1-r11 |
| Chainguard | neo4j-2025.05-docker-publish | 0 | 2025.05.1-r11 |
| Chainguard | neo4j-2025.06 | 0 | 2025.06.2-r11 |
| Chainguard | neo4j-2025.06-browser | 0 | 2025.06.2-r11 |
| Chainguard | neo4j-2025.06-docker-publish | 0 | 2025.06.2-r11 |
| Chainguard | neo4j-2025.07 | 0 | 2025.07.1-r10 |
| Chainguard | neo4j-2025.07-browser | 0 | 2025.07.1-r10 |
| Chainguard | neo4j-2025.07-docker-publish | 0 | 2025.07.1-r10 |
| Chainguard | neo4j-2025.08 | 0 | 2025.08.0-r8 |
| Chainguard | neo4j-2025.08-browser | 0 | 2025.08.0-r8 |
| Chainguard | neo4j-2025.08-docker-publish | 0 | 2025.08.0-r8 |
| Chainguard | neo4j-2025.09 | 0 | 2025.09.0-r5 |
| Chainguard | neo4j-2025.09-browser | 0 | 2025.09.0-r5 |
| Chainguard | neo4j-2025.09-docker-publish | 0 | 2025.09.0-r5 |
| Chainguard | neo4j-2025.10 | 0 | 2025.10.1-r3 |
| Chainguard | neo4j-2025.10-browser | 0 | 2025.10.1-r3 |
| Chainguard | neo4j-2025.10-docker-publish | 0 | 2025.10.1-r3 |
| Chainguard | neo4j-4.4-docker-publish | 0 | 4.4.46-r3 |
| Chainguard | neo4j-5.26 | 0 | 5.26.18-r2 |
| Chainguard | neo4j-5.26-docker-publish | 0 | 5.26.18-r2 |
| Chainguard | neo4j-5.26-oci-entrypoint | 0 | 5.26.18-r2 |
| Chainguard | opensearch-2 | 0 | 2.19.4-r6 |
| Chainguard | opensearch-2-alerting | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-analysis-icu | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-analysis-kuromoji | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-analysis-nori | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-analysis-phonetic | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-analysis-smartcn | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-analysis-stempel | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-analysis-ukrainian | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-anomaly-detection | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-asynchronous-search | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-cross-cluster-replication | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-crypto-kms | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-custom-codecs | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-discovery-azure-classic | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-discovery-ec2 | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-discovery-gce | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-entrypoint-compat | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-geospatial | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-identity-shiro | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-index-management | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-ingest-attachment | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-job-scheduler | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-k-nn | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-mapper-annotated-text | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-mapper-murmur3 | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-mapper-size | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-ml-commons | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-neural-search | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-notifications | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-observability | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-reporting | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-repository-azure | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-repository-gcs | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-repository-s3 | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-security | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-security-analytics | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-sql | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-store-smb | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-telemetry-otel | 0 | 2.19.4-r3 |
| Chainguard | opensearch-2-transport-nio | 0 | 2.19.4-r3 |
| Chainguard | opensearch-3 | 0 | 3.5.0-r0 |
| Chainguard | opensearch-3-alerting | 0 | 3.4.0-r0 |
| Chainguard | opensearch-3-analysis-icu | 0 | 3.4.0-r0 |
| Chainguard | opensearch-3-analysis-kuromoji | 0 | 3.4.0-r0 |
| Chainguard | opensearch-3-analysis-nori | 0 | 3.4.0-r0 |
| Chainguard | opensearch-3-analysis-phonetic | 0 | 3.4.0-r0 |
| Chainguard | opensearch-3-analysis-smartcn | 0 | 3.4.0-r0 |
| Chainguard | opensearch-3-analysis-stempel | 0 | 3.4.0-r0 |
| Chainguard | opensearch-3-analysis-ukrainian | 0 | 3.4.0-r0 |
| Chainguard | opensearch-3-anomaly-detection | 0 | 3.4.0-r0 |
| Chainguard | opensearch-3-asynchronous-search | 0 | 3.4.0-r0 |
| Chainguard | opensearch-3-cross-cluster-replication | 0 | 3.4.0-r0 |
| Chainguard | opensearch-3-crypto-kms | 0 | 3.4.0-r0 |
| Chainguard | opensearch-3-custom-codecs | 0 | 3.4.0-r0 |
| Chainguard | opensearch-3-discovery-azure-classic | 0 | 3.4.0-r0 |
| Chainguard | opensearch-3-discovery-ec2 | 0 | 3.4.0-r0 |
| Chainguard | opensearch-3-discovery-gce | 0 | 3.4.0-r0 |
| Chainguard | opensearch-3-geospatial | 0 | 3.4.0-r0 |
| Chainguard | opensearch-3-identity-shiro | 0 | 3.4.0-r0 |
| Chainguard | opensearch-3-index-management | 0 | 3.4.0-r0 |
| Chainguard | opensearch-3-ingest-attachment | 0 | 3.4.0-r0 |
| Chainguard | opensearch-3-job-scheduler | 0 | 3.4.0-r0 |
| Chainguard | opensearch-3-k-nn | 0 | 3.4.0-r0 |
| Chainguard | opensearch-3-mapper-annotated-text | 0 | 3.4.0-r0 |
| Chainguard | opensearch-3-mapper-murmur3 | 0 | 3.4.0-r0 |
| Chainguard | opensearch-3-mapper-size | 0 | 3.4.0-r0 |
Related vulnerabilities
- CVE-2021-44832 Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2… Also affects org.apache.logging.log4j:log4j-core
- CVE-2021-45105 Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not… Also affects org.apache.logging.log4j:log4j-core
- CVE-2021-44228 Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and… Also affects org.apache.logging.log4j:log4j-core
- CVE-2017-5645 In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server… Also affects org.apache.logging.log4j:log4j-core
- CVE-2025-69229 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Also affects airflow-3-compat
- CVE-2025-69223 AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb Also affects airflow-3-compat
- CVE-2025-69224 AIOHTTP's unicode processing of header values could cause parsing discrepancies Also affects airflow-3-compat
- CVE-2025-69226 AIOHTTP vulnerable to brute-force leak of internal static file path components Also affects airflow-3-compat