After Log4Shell was disclosed on 10 December 2021, two more Log4j CVEs followed within a week: CVE-2021-45046 on 13 December and CVE-2021-45105 on 16 December. Teams that upgraded on day one to 2.15.0 had to upgrade again. The lesson is to plan for follow-up releases, not to stop patching.
The timeline
CISA's advisory AA21-356A, revised on 23 December 2021, lays out the three issues.
- CVE-2021-44228, 10 December. Remote code execution through JNDI lookups. Affects 2.0-beta9 through 2.14.1 per CISA.
- CVE-2021-45046, 13 December. Could cause remote code execution, denial of service or other effects in certain non-default configurations. Affects 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0.
- CVE-2021-45105, 16 December. Denial of service in certain non-default configurations, where a Pattern Layout with a Context Lookup allows a recursive lookup and a StackOverflowError.
CISA also reports that CVE-2021-45046 was observed being exploited.
Which version ended up being the target
CISA's guidance for Java 8 or later is Log4j 2.17.0, released on 17 December 2021, or newer. For Java 7 it lists 2.12.3, released on 21 December, and notes that Java 7 is end of life, so moving to Java 8 is recommended. The Apache page lists 2.15.0 as the first fix for the original CVE, which is why early patchers were left exposed to the next one.
Why follow-up fixes happen
The first fix is written under pressure and aimed at the reported exploit. Researchers then look at the same code with fresh attention and find the neighbouring cases. The first Log4j fix did not close every path, so more reports arrived. This is common after a high profile disclosure and does not mean maintainers were careless.
How to plan for it
- Do not close the ticket at the first upgrade. Keep it open for at least a few days and watch the project's security page and advisories.
- Pick the newest fixed version, not the minimum. If a later fixed release exists when you do the work, use it.
- Automate the check. A scheduled dependency scan flags a still vulnerable version after a follow-up CVE lands, without anyone remembering to look.
- Keep rollback cheap. Rapid version bumps are safer when you can deploy and revert in minutes.
- Record what you did. For each service, note the version before and after and the date. That record answers customer and auditor questions later.
A note on workarounds
CISA lists removing JndiLookup.class from the classpath as a temporary workaround and warns it can cause instability. Treat workarounds as a bridge to the upgrade.
Safeguard's continuous dependency scanning can re-evaluate your SBOMs when new advisories appear, which suits this pattern. For the original bug, see why a logging library ran attacker code.
Quick check
Was 2.15.0 enough?
Not for long. CVE-2021-45046 affected versions up to and including 2.15.0, according to CISA's advisory.
What does CISA recommend for Java 8 or later?
Log4j 2.17.0 or newer, per the revised advisory.
Sources
Last reviewed: 19 October 2026.
