Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender

CVE-2023-26464

What is CVE-2023-26464?

An improper deserialization of a specially crafted deeply nested hashmap or hashtable in the Chainsaw or SocketAppender components of Apache Log4j 1.x can lead to exhaustion of available memory in the Java Virtual Machine (JVM). This vulnerability arises when the components operate on JRE versions prior to 1.7, allowing attackers to craft logging entries that exploit this issue effectively. Affected systems are strongly advised to upgrade to Log4j 2.x, as the existing versions have reached the end of their support lifecycle.

References