Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Log4j API and Core packages can be exploited
published 1 day ago
Summary
The Log4j API and Core libraries used in many Java applications have two security weaknesses. If left unpatched, attackers could run malicious code on your systems. Update to the new TuxCare package version 2.24.1‑tuxcare.4 as soon as possible.
What to do
- Update apache org.apache.logging.log4j:log4j-api to version 2.24.1-tuxcare.4.
- Update apache org.apache.logging.log4j:log4j-core to version 2.24.1-tuxcare.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| TuxCare:Maven | apache | org.apache.logging.log4j:log4j-api |
>= 2.24.1, < 2.24.1-tuxcare.4 Fix: upgrade to 2.24.1-tuxcare.4
|
| TuxCare:Maven | apache | org.apache.logging.log4j:log4j-core |
>= 2.24.1, < 2.24.1-tuxcare.4 Fix: upgrade to 2.24.1-tuxcare.4
|
Original advisory text
TuxCare security update for org.apache.logging.log4j (2 CVEs)
TuxCare rebuilt 2 org.apache.logging.log4j packages to address 2 CVEs. Fixed in 2.24.1-tuxcare.4.
Timeline
Published3 Nov 2026
Updated4 Nov 2026
First seen4 Nov 2026
Sources
CLSA-2026-1793727635 · OSV
Track software like this
Free during beta