CVE-2017-5645
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another applic
CVSS
9.8
Critical
EPSS
89.8%
p100
KEV
—
Exploit Today
30
0-100
Published: Apr 17, 2017 · Last modified: Oct 8, 2026 · CWE-502
89.8%EPSS · 30 days89.8%
2026-09-222026-10-19
In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
- www.openwall.comhttp://www.openwall.com/lists/oss-security/2019/12/19/2
- www.oracle.comhttp://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html
- www.oracle.comhttp://www.oracle.com/technetwork/security-advisory/cpujan2018-3236628.html
- www.oracle.comhttp://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- www.oracle.comhttp://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
- www.securityfocus.comhttp://www.securityfocus.com/bid/97702
- www.securitytracker.comhttp://www.securitytracker.com/id/1040200
- www.securitytracker.comhttp://www.securitytracker.com/id/1041294
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2017:1417
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2017:1801
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2017:1802
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2017:2423
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2017:2633
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2017:2635
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2017:2636
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2017:2637
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2017:2638
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2017:2808
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2017:2809
- access.redhat.comhttps://access.redhat.com/errata/RHSA-2017:2810
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-90799——
———Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.6hCVE-2026-1133567.5 HIG—
———DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer for arbitrary file write, deletion, and code execution.5hCVE-2026-1134048.8 HIG—
——0WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server.6hCVE-2026-123506.5 MED—
——0IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process.1dCVE-2026-121556.5 MED—
——0IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigger a NULL pointer dereference.1dCVE-2026-121487.5 HIG—
——0IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java.12h