Do Son An unpatched Log4j RCE vulnerability was publicly disclosed on Apache's issue tracker. No CVE is assigned and no fix exists yet. Workaround inside.
Log4j
Log4j’s Security Blind Spot: New TLS Flaw Lets Attackers Intercept Sensitive Logs Despite Encryption
Log4j’s Security Blind Spot: New TLS Flaw Lets Attackers Intercept Sensitive Logs Despite Encryption
A new Log4j flaw (CVE-2025-68161) breaks TLS hostname verification, allowing Man-in-the-Middle attacks on log data. Upgrade to v2.25.3 now.
Stay informed about the ongoing threat of Log4Shell. Learn how this vulnerability is being exploited by threat actors and the impact it has on global cybersecurity.