What is the latest version of org.apache.logging.log4j:log4j-core?

The latest version of org.apache.logging.log4j:log4j-core is 3.0.0-beta3, published November 2024.

What license is org.apache.logging.log4j:log4j-core under?

org.apache.logging.log4j:log4j-core declares Apache-2.0 as its top-level declared license. Its dependency tree spans 3 distinct licenses.

Does org.apache.logging.log4j:log4j-core have known vulnerabilities?

org.apache.logging.log4j:log4j-core has 3 known CVE-linked advisories across its published versions; 0 affect the latest version, v3.0.0-beta3.

How do I install org.apache.logging.log4j:log4j-core?

Add org.apache.logging.log4j:log4j-core to your pom.xml as a dependency on org.apache.logging.log4j:log4j-core:3.0.0-beta3.

How do I generate an SBOM that includes org.apache.logging.log4j:log4j-core?

FOSSA's SBOM generator produces SPDX or CycloneDX output for a codebase that includes org.apache.logging.log4j:log4j-core.

Skip to package details

org.apache.logging.log4j:log4j-core

Maven

v3.0.0-beta3 · Nov 2024 · Apache-2.0 (top-level declared license)

Maven (pom.xml)Gradle (build.gradle.kts)

<dependency>
  <groupId>org.apache.logging.log4j</groupId>
  <artifactId>log4j-core</artifactId>
  <version>3.0.0-beta3</version>
</dependency>

implementation("org.apache.logging.log4j:log4j-core:3.0.0-beta3")

3 known CVEs (0 in v3.0.0-beta3)
239 known dependents
★ 3.6k
78 versions

Description

Apache Log4j is a versatile, feature-rich, efficient logging API and backend for Java.

Licenses

Declared license

Apache-2.0 (top-level declared license of org.apache.logging.log4j:log4j-core)

Transitive dependency licenses

This package's dependency tree includes LGPL-2.1-only, which may require you to publish changes to that component when you distribute.

License	Category	Dependencies
Apache-2.0	Permissive	12 of 14
Apache-2.0 OR EPL-2.0	Permissive	1 of 14
LGPL-2.1-only	Weak copyleft	1 of 14

This view is derived from declared package metadata, and a full FOSSA scan detects licenses that declared metadata misses. Scan free.

License and vulnerability information on this page is derived from public package metadata and public advisory databases. It is not legal advice, and it reflects the top-level declared license only. Verify the license and terms of any software for your own needs.

Need org.apache.logging.log4j:log4j-core approved? Get the full license and vulnerability report for your codebase. Scan free.

Scan free

Vulnerabilities

CVE-linked advisories
Affected range	CVE	CWE	EPSS
>=2.0-alpha1 <2.25.4	CVE-2026-34480	CWE-116	0.01187
>=2.21.0 <2.25.4	CVE-2026-34478	CWE-117, CWE-684	0.01187
>=2.12.0 <2.25.4	CVE-2026-34477	CWE-297	0.00502

Remediation

Fix versions
CVE	Issue	Impacted	Fixed in
CVE-2026-34480	Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters	>=2.0-alpha1 <2.25.4	2.25.4
CVE-2026-34478	Apache Log4j Core: log injection in `Rfc5424Layout` due to silent configuration incompatibility	>=2.21.0 <2.25.4	2.25.4
CVE-2026-34477	Apache Log4j Core: `verifyHostName` attribute silently ignored in TLS configuration	>=2.12.0 <2.25.4	2.25.4

Find and fix org.apache.logging.log4j:log4j-core issues across your dependencies.

Scan free

Version history

Published versions
Version	Published	License
3.0.0-beta3	Nov 2024	Apache-2.0
2.24.1	Sep 2024
2.24.0	Sep 2024
2.23.1	Mar 2024
2.23.0	Feb 2024
2.22.1	Dec 2023
2.22.0	Nov 2023
2.21.1	Oct 2023
2.21.0	Oct 2023
2.20.0	Feb 2023
2.19.0	Sep 2022
2.18.0	Jun 2022
2.17.2	Feb 2022
2.3.2	Dec 2021
2.12.4	Dec 2021
2.17.1	Dec 2021
2.3.1	Dec 2021
2.12.3	Dec 2021
2.17.0	Dec 2021
2.12.2	Dec 2021
2.16.0	Dec 2021
2.15.0	Dec 2021
2.14.1	Mar 2021
2.14.0	Nov 2020
2.13.3	May 2020

26 older releases

Older published versions
Version	Published	License
2.13.2	Apr 2020
2.13.1	Feb 2020
2.13.0	Dec 2019
2.12.1	Aug 2019
2.12.0	Jun 2019
2.11.2	Feb 2019
2.11.1	Jul 2018
2.11.0	Mar 2018
2.10.0	Nov 2017
2.9.1	Sep 2017
2.9.0	Aug 2017
2.8.2	Apr 2017
2.8.1	Feb 2017
2.8	Jan 2017
2.7	Oct 2016
2.6.2	Jul 2016
2.6.1	Jun 2016
2.6	May 2016
2.5	Dec 2015
2.4.1	Oct 2015
2.4	Sep 2015
2.3	May 2015
2.2	Feb 2015
2.1	Oct 2014
2.0.2	Aug 2014
2.0.1	Jul 2014

Latest pre-release: 3.0.0-beta2 (Feb 2024). Pre-releases (canary, beta, release candidate and similar) are not listed.

Dependencies

Direct dependencies

10 direct dependencies, 14 in total including transitive. Licenses across the full tree are summarized under Licenses.

Direct dependencies
Package	Version range	License
biz.aQute.bnd:biz.aQute.bnd.annotation	7.0.0	Apache-2.0 OR EPL-2.0
com.github.spotbugs:spotbugs-annotations	4.8.6	LGPL-2.1
com.google.errorprone:error_prone_annotations	2.32.0	Apache-2.0
org.apache.logging.log4j:log4j-api	2.24.1	Apache-2.0
org.apache.logging.log4j:log4j-kit	3.0.0-beta3	Apache-2.0
org.apache.logging.log4j:log4j-plugins	3.0.0-beta3	Apache-2.0
org.jspecify:jspecify	1.0.0	Apache-2.0
org.osgi:org.osgi.annotation.bundle	2.0.0	Apache-2.0
org.osgi:org.osgi.framework	1.10.0	Apache-2.0
org.osgi:osgi.annotation	8.1.0	Apache-2.0

Dependents

org.springframework.boot:spring-boot-starter-log4j2
com.alibaba:druid
org.apache.logging.log4j:log4j-slf4j-impl
org.elasticsearch:elasticsearch
org.apache.logging.log4j:log4j-web

Based on what each package declares in its published metadata. The dependencies your build actually installs can differ, and a FOSSA scan of your project resolves the full tree.

Popularity

Known dependents in this corpus: 239
GitHub stars: 3.6k
OpenSSF score: 9 / 10

FAQ

What is the latest version of org.apache.logging.log4j:log4j-core?: The latest version of org.apache.logging.log4j:log4j-core is 3.0.0-beta3, published November 2024.
What license is org.apache.logging.log4j:log4j-core under?: org.apache.logging.log4j:log4j-core declares Apache-2.0 as its top-level declared license. Its dependency tree spans 3 distinct licenses.
Does org.apache.logging.log4j:log4j-core have known vulnerabilities?: org.apache.logging.log4j:log4j-core has 3 known CVE-linked advisories across its published versions; 0 affect the latest version, v3.0.0-beta3.
How do I install org.apache.logging.log4j:log4j-core?: Add org.apache.logging.log4j:log4j-core to your pom.xml as a dependency on org.apache.logging.log4j:log4j-core:3.0.0-beta3.
How do I generate an SBOM that includes org.apache.logging.log4j:log4j-core?: FOSSA's SBOM generator produces SPDX or CycloneDX output for a codebase that includes org.apache.logging.log4j:log4j-core. Generate an SPDX or CycloneDX SBOM free.