CVE-2025-68161

Name of the Vulnerable Software and Affected Versions Apache Log4j Core versions 2.0-beta9 through 2.25.2

Description The Socket Appender in Apache Log4j Core does not verify the hostname of the peer certificate during TLS connections, even when configured to do so. This could allow a man-in-the-middle attacker to intercept or redirect log traffic if they can present a valid certificate trusted by the system. The attacker needs to be able to intercept network traffic between the client and the log receiver and possess a certificate issued by a trusted certification authority.

Recommendations Upgrade to Apache Log4j Core version 2.25.3. As an alternative, configure the Socket Appender to use a private or restricted trust root to limit the set of trusted certificates.