How to Safely Upgrade to Log4j2 2.17.0 and Mitigate CVE‑2021‑45105

Log4j2 2.17.0 released

After the 2.16.0 update many thought the Log4j2 vulnerability was resolved, but Log4j released a new version 2.17.0.

What is fixed

The release addresses security issue CVE‑2021‑45105 , which affects Log4j‑core versions from 2.0‑alpha1 up to 2.16.0 (1.x users are not affected).

Vulnerability details

The flaw is triggered only when a non‑default PatternLayout uses Context Lookups such as ${ctx:loginId} or $${ctx:loginId}. An attacker can supply malicious input that causes infinite recursion, leading to a StackOverflowError and process crash.

How to fix

Upgrade log4j-core to version 2.17.0. Example Maven dependency:

<dependency>
    <groupId>org.apache.logging.log4j</groupId>
    <artifactId>log4j-core</artifactId>
    <version>2.17.0</version>
</dependency>

If you use Spring Boot, the same one‑line configuration that was used for 2.16.0 can be applied.

Temporary mitigations

In PatternLayout, replace ${ctx:loginId} or $${ctx:loginId} with %X, %mdc or %MDC.

Remove any references to Context Lookups (e.g., ${ctx:loginId} or $${ctx:loginId}) from external data such as HTTP headers or user input.

Perform a quick self‑check and apply the necessary protection as soon as possible.