CVE-2025-68161
Apache Log4j Core: Missing TLS hostname verification in Socket appender
Description
The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true. This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions: * The attacker is able to intercept or redirect network traffic between the client and the log receiver. * The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured). Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue. As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates.
INFO
Published Date :
Dec. 18, 2025, 9:15 p.m.
Last Modified :
Jan. 20, 2026, 1:15 a.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] | ||||
| CVSS 4.0 | MEDIUM | f0158376-9dc2-43b6-827c-5f631a4d8d09 | ||||
| CVSS 4.0 | MEDIUM | [email protected] |
Solution
- Upgrade Apache Log4j Core to version 2.25.3.
- Configure Socket Appender with a restricted trust root.
- Verify TLS hostname verification is correctly configured.
Public PoC/Exploit Available at Github
CVE-2025-68161 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-68161.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-68161 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-68161
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
CSOnline - Sistema completo de gestão de entregas e logística. Backend Jakarta EE com APIs REST + Frontend Vue 3 SPA. Módulos: Usuários, Entregadores, Clientes, Entregas, Equipes, SMS/WhatsApp e Preços.
Java HTML JavaScript Vue PowerShell Shell CSS
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-68161 vulnerability anywhere in the article.
-
CybersecurityNews
Apache Log4j Vulnerability Allow Attackers to Intercept Sensitive Log Data
Apache Logging Services has disclosed a critical security vulnerability in Log4j Core that exposes applications to potential interception of log data. The flaw resides in the Socket Appender component ... Read more
-
Daily CyberSecurity
Log4j’s Security Blind Spot: New TLS Flaw Lets Attackers Intercept Sensitive Logs Despite Encryption
The Apache Software Foundation has released a security update for its widely used Log4j logging library, addressing a moderate-severity vulnerability that could allow attackers to intercept sensitive ... Read more
The following table lists the changes that have been made to the
CVE-2025-68161 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Jan. 20, 2026
Action Type Old Value New Value Added Reference https://lists.debian.org/debian-lts-announce/2026/01/msg00015.html -
Initial Analysis by [email protected]
Jan. 12, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N Added CWE CWE-295 Added CPE Configuration OR *cpe:2.3:a:apache:log4j:2.0:rc1:*:*:*:*:*:* *cpe:2.3:a:apache:log4j:2.0:beta9:*:*:*:*:*:* *cpe:2.3:a:apache:log4j:2.0:rc2:*:*:*:*:*:* *cpe:2.3:a:apache:log4j:2.0:-:*:*:*:*:*:* *cpe:2.3:a:apache:log4j:2.0:rc1-rc1:*:*:*:*:*:* *cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* versions from (including) 2.0.1 up to (excluding) 2.25.3 Added Reference Type Apache Software Foundation: https://github.com/apache/logging-log4j2/pull/4002 Types: Issue Tracking, Patch Added Reference Type Apache Software Foundation: https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx Types: Mailing List Added Reference Type Apache Software Foundation: https://logging.apache.org/cyclonedx/vdr.xml Types: Vendor Advisory Added Reference Type Apache Software Foundation: https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName Types: Product Added Reference Type Apache Software Foundation: https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName Types: Product Added Reference Type Apache Software Foundation: https://logging.apache.org/security.html#CVE-2025-68161 Types: Exploit, Vendor Advisory Added Reference Type CVE: http://www.openwall.com/lists/oss-security/2025/12/18/1 Types: Mailing List -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Dec. 18, 2025
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2025/12/18/1 -
New CVE Received by [email protected]
Dec. 18, 2025
Action Type Old Value New Value Added Description The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName configuration attribute or the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property is set to true. This issue may allow a man-in-the-middle attacker to intercept or redirect log traffic under the following conditions: * The attacker is able to intercept or redirect network traffic between the client and the log receiver. * The attacker can present a server certificate issued by a certification authority trusted by the Socket Appender’s configured trust store (or by the default Java trust store if no custom trust store is configured). Users are advised to upgrade to Apache Log4j Core version 2.25.3, which addresses this issue. As an alternative mitigation, the Socket Appender may be configured to use a private or restricted trust root to limit the set of trusted certificates. Added CVSS V4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-297 Added Reference https://github.com/apache/logging-log4j2/pull/4002 Added Reference https://lists.apache.org/thread/xr33kyxq3sl67lwb61ggvm1fzc8k7dvx Added Reference https://logging.apache.org/cyclonedx/vdr.xml Added Reference https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName Added Reference https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName Added Reference https://logging.apache.org/security.html#CVE-2025-68161