Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
☕
☕ Maven
Not in CISA KEV
HIGH severity

CVE-2022-23307 — log4j

HIGH

CVE-2022-23307 is a high-severity (CVSS 8.8) Deserialization of Untrusted Data vulnerability in log4j:log4j. EPSS puts its 30-day exploitation probability at 54.4% (99th percentile). No vendor fix is recorded yet; mitigation options are listed below.

A deserialization flaw in the Chainsaw component of Log4j 1 can lead to malicious code execution.

Also known asGHSA-f7vh-qwp3-x37m
Published
Updated
Affected
2 pkgs
Patched
See advisory
Exploits
None indexed
Exploitation data as of Oct 11, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • A successful exploit gives an attacker total control of the affected component, not partial access.
  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2022-23307.

EPSS Exploitation Probability

via FIRST.org ↗
54.4%probability of exploitation in next 30 days
High Risk0.00%
Lower risk than most CVEs99th percentile — riskier than 99% of all scored CVEsHighest risk
0.00%23.4%46.7%70.1%2.2%54.4%Apr 26Jul 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2022-23307 by exploitation likelihood (EPSS) against impact (CVSS). In the shaded patch-first corner (EPSS 50%+, CVSS 7.0+).

Where this sits among everything scored

Of 385,987 CVEs with a current EPSS score, this one falls in the 50–90% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

2 pkgs affected
☕log4j:log4j☕org.zenframework.z8.dependencies.commons:log4j-1.2.17

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

Users are advised to migrate from log4j:log4j to org.apache.logging.log4j:log4j for an updated version of the library.

Affected Packages

2 total
EcosystemPackageVulnerable rangeFix
☕Mavenlog4j:log4jall versionsNo fix
☕Mavenorg.zenframework.z8.dependencies.commons:log4j-1.2.17all versionsNo fix

Affected Products

26 products · 39 configurations
Application
chainsawapache
< 2.1.0
range
Application
log4japache
≥ 1.2 && < 2.0
range
Application
advanced supply chain planningoracle
2 versions
12.112.2
Application
business intelligenceoracle
3 versions
5.9.0.0.012.2.1.3.012.2.1.4.0
Application
business process management suiteoracle
2 versions
12.2.1.3.012.2.1.4.0
Application
communications eagle ftp table base retrievaloracle
1 version
4.5

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for log4j:log4j, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Remediation status

    No patched version of log4j:log4j has shipped for CVE-2022-23307 yet. Where your build allows, override or pin the dependency away from the vulnerable range, and apply any maintainer-recommended mitigation.

  3. Mitigate without a patch

    Do not deserialise data from untrusted sources: where the format allows it, restrict deserialisation to an explicit allowlist of expected types, and prefer a data-only format (JSON, Protobuf) over one that can reconstruct arbitrary objects until you can upgrade.

Fixing This On Your OS

If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.

Red HatImportant

Chainsaw is a standalone graphical user interface for viewing log entries in log4j. This flaw may be bypassed by using other available means to access log entries. Red Hat Satellite bundles log4j-over-slf4j with Candlepin, however, product is not affected as it uses logback framework for logging. Red Hat…

Workaround published by Red Hat
These are the mitigations available for this flaw for log4j 1.x: - Avoid using Chainsaw to view logs, and instead use some other utility, especially if there is a log view available within the product itself. - Remove the Chainsaw classes from the log4j jar files. For example: ``` zip -q -d log4j-*.jar org/apache/log4j/chainsaw/* ``` (log4j jars may be nested in zip archives within product)
Source: Red Hat security advisory for CVE-2022-23307 (CC BY 4.0)
ProductFixed inAdvisory
EAP 6.4.24 releasesee advisoryRHSA-2022:5458
EAP 6.4 log4j asynclog4jRHSA-2022:0437
Red Hat AMQ Streams 1.6.7see advisoryRHSA-2022:0467
Red Hat AMQ Streams 2.0.1log4jRHSA-2022:0469
Red Hat Data Grid 7.3.9log4jRHSA-2022:0430
Red Hat Enterprise Linux 6 Extended Lifecycle Supportlog4j-0:1.2.14-6.6.el6_10RHSA-2022:0442
Red Hat Enterprise Linux 8parfait:0.5-8050020220124063900.6b489b78RHSA-2022:0290
Red Hat Enterprise Linux 8.1 Update Services for SAP Solutionsparfait:0.5-8010020220124232535.d5701770RHSA-2022:0294

Frequently Asked Questions

CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists. Users are advised to migrate from `log4j:log4j` to `org.apache.logging.log4j:log4j` for an updated version of the library.
O3 Security · Impact-Aware SCA

Is CVE-2022-23307 in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2022-23307: log4j (High 8.8)