Security support for Log4j 1.x
Log4j 1.x reached end of life in 2015, yet 1.2.17 still ships inside many Java applications. This is its last release, with every vulnerability the US National Vulnerability Database lists for it.
Request a server assessmentLog4j 1.x
| Log4j | Release | Known CVEs | Critical | Exploited | Forkward |
|---|---|---|---|---|---|
| 1.2.17 | Last Log4j 1.x release, end of life since 2015 | 6 | 3 | 0 | Patch on order, 48 h |
Vulnerabilities from the US National Vulnerability Database, 28 October 2026, for the upstream version, counting only entries where Log4j itself is the vulnerable product. Exploited: listed in the CISA catalogue of known exploited vulnerabilities. Your assessment shows which of them are real on your systems.
Java libraries
Spring Framework, Spring Boot, Apache Tomcat and Log4j: the versions past end of life and what affects them. All Java libraries
Patch on order, 48 h
We backport the fix to the version you run within 48 hours of your order, or within 24 hours with priority delivery. See the plans