A newly disclosed Apache Log4j2 issue could allow attackers to bypass a deserialization allowlist and execute code remotely in narrowly defined deployments. The issue, tracked as Log4j2 #4255, affects applications that accept serialized Log4j events through a network-accessible Java deserialization path. The reported weakness involves Log4j’s FilteredObjectInputStream, a utility designed to restrict which Java classes can be loaded while reading serialized log events. Its allowlist includes Java.rmi MarshalledObject, a Java container that can store another serialized object as an opaque byte array. Researchers found that this outer object can pass the Log4j allowlist while concealing a malicious inner object. When Log4j later calls MarshalledObject.get(), Java deserializes the embedded payload using a fresh, unfiltered ObjectInputStream. This means the original allowlist does not inspect the hidden object graph. New Apache Log4j2 Vulnerability The vulnerable flow is linked to Log4jLogEvent$LogEventProxy, the serialized representation of a Log4j event. The proxy places the event message inside a MarshalledObject and retrieves it automatically during deserialization. An attacker could craft a malicious serialized Log4j event, send it to a vulnerable receiver, and cause a gadget chain available on the target classpath to execute. Dinosn reports Log4j2 #4255 on GitHub , where a public reproduction lab demonstrated the issue in Log4j 2.26.1 running on JDK 17. In the test environment, a malicious payload embedded in a MarshalledObject triggered code execution when processed by an unauthenticated TCP receiver using FilteredObjectInputStream. The lab also showed that a Commons Collections 3.2.1 gadget chain could execute without requiring an attacker-supplied class on the victim system. However, the issue is not comparable to the widespread Log4Shell vulnerability . It cannot be triggered simply by placing a malicious string into an application log message. Exploitation requires a specific and uncommon setup: an application must expose a receiver that accepts attacker-controlled serialized Log4j events, processes them using FilteredObjectInputStream, and includes a usable chain of Java deserialization gadgets. Apache’s security guidance stresses that current Log4j Core production code does not normally deserialize data received from sockets, queues, or other external sources. The project describes FilteredObjectInputStream as a defense-in-depth utility rather than a complete security boundary. It warns that applications should not deserialize untrusted log event streams. Organizations should identify legacy serialized Log4j event receivers, especially unauthenticated network services based on old socket bridge patterns. A temporary mitigation is to configure the JVM serialization filter to reject Java.rmi.MarshalledObject, although this may also block legitimate serialized Log4j events. More durable defenses include removing Java serialization from log transport, upgrading or removing vulnerable gadget dependencies, using mutually authenticated endpoints, and migrating to JSON or RFC 5424 logging over TLS. Apache specifically recommends structured formats and TLS rather than Java-serialized log transport. At the time of reporting, Log4j2 issue #4255 remained open and had no assigned CVE. The flaw is best understood as a dangerous deserialization bypass in legacy or custom Log4j event receivers, not a universal remote code execution flaw affecting ordinary Log4j deployments. Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs:  Integrate TI Lookup in your SOC The post New Apache Log4j2 Flaw Lets Attackers Bypass Security Checks and Execute Remote Code appeared first on Cyber Security News .

What's Changed Incorporates the latest versions of OpenRewrite (v8.62.4), the rewrite-gradle-plugin (v7.17.0), and the rewrite-maven-plugin (v6.19.0) to improve code parsing accuracy and recipe ex...

Fast logging module written in Rust. Contribute to brmmm3/fastlogging-rs development by creating an account on GitHub.

I recently read and shared You’re Wasting Time in Java Without These 10 Libraries. I commented on it a bit in my newsletter, but given the amount and intensity of reactions, I think a full-blown post ...

The flaw CVE-2021-44832 is Apache Log4j2 library is still a serious problem for multiple industries, experts warn it threatens global Finance.

You can use this guide to discover, understand and use the right Java logging library for your applications, like Log4j2, Logback, or java.util.logging.

What's Changed Upgrades to Struts 7 by @lukaszlenart in #597 Dependencies Update log4j2 monorepo to v2.24.3 by @renovate in #588 Update dependency org.junit.jupiter:junit-jupiter to v5.11.4 by @...

Learn how to use MDC with Log4j, Log4j2 and Logback.

Last Updated: 2026-08-26T17:05:28Z (UTC) What’s Happening A currently unconfirmed vulnerability in Apache Log4j could allow remote code execution (RCE) by bypassing the allowlist enforced by FilteredObjectInputStream (FOIS) during Java deserialization. Exploitation requires an uncommon configuration in which an application or logging service accepts serialized Log4j LogEvent objects through an FOIS-based receiver, as well as a suitable deserialization gadget on the target classpath. Unlik...

If you want to get logs from your Java application ingested into an OpenTelemetry-compatible logs backend, the easiest and recommended way is using an OpenTelemetry protocol (OTLP) exporter. However,…

Xe Iaso's personal website.

Introduction: In December 2021, the cybersecurity community was rocked by the disclosure of CVE-2021-44228, a remote code execution (RCE) vulnerability in Apache Log4j2, a ubiquitous Java logging library. Dubbed Log4Shell, this flaw allowed unauthenticated attackers to execute arbitrary code on millions of servers, cloud services, and enterprise applications, making it one of the most severe vulnerabilities in recent history. This article dissects the exploit mechanics, provides hands‑on steps for detection and mitigation across Linux and Windows environments, and outlines long‑term strategies to defend against similar supply chain attacks.

This sounds terrifying. It isn’t Log4Shell 2.0. That’s important. The problem is real, and researchers demonstrated the technical path on Log4j 2.26.1 with JDK 17....

You can use this guide to discover, understand and use the right Java logging library for your applications, like Log4j2, Logback, or java.util.logging.

What's Changed Upgrades to Struts 7 by @lukaszlenart in #353 Reconfigures renovate to keep 6.0.x branch up to date by @lukaszlenart in #357 Update log4j2 monorepo to v2.24.3 (release/5.0.x) by @re...

Description LoggerContext / LoggerRegistry don't play well together in using weak references, which can result in a null logger if the GC kicks in at a bad timing. Configuration Version: 2.24.1 Ope...

Introduction: The Log4Shell vulnerability (CVE-2021-44228) in the popular Apache Log4j2 logging library sent shockwaves through the cybersecurity community due to its ease of exploitation and widespread impact. This critical remote code execution (RCE) flaw allows unauthenticated attackers to take full control of affected systems by simply sending a specially crafted string to a logged service. Understanding how this attack works and how to defend against it is essential for any IT professional responsible for Java-based applications and infrastructure.

Upgrade Jackson from 2.x to 3.0.0-rc5

You may have noticed that activity on the public Log4cxx, Log4j, and Log4net repositories has slowed since December 2025. I want to reassure you that the projects are still being actively monitored...