CVE-2023-26464

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

** UNSUPPORTED WHEN ASSIGNED **

When using the Chainsaw or SocketAppender components with Log4j 1.x on JRE less than 1.7, an attacker that manages to cause a logging entry involving a specially-crafted (ie, deeply nested) hashmap or hashtable (depending on which logging component is in use) to be processed could exhaust the available memory in the virtual machine and achieve Denial of Service when the object is deserialized.

This issue affects Apache Log4j before 2. Affected users are recommended to update to Log4j 2.x.

NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-502

Affected software

No affected versions have been published.

Timeline

Published
Mar 10, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-264656.1Pega Platform versions 7.2 to 8.8.1 are affected by an XSS issue.CVE-2023-264667.8A user with non-Admin access can change a configuration file on the client to modify the Server URL.CVE-2023-264675.4A man in the middle can redirect traffic to a malicious server in a compromised configuration.CVE-2023-264689.1Cerebrate 1.12 does not properly consider organisation_id during creation of API keys.CVE-2023-264699.8In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.CVE-2023-26478.8A vulnerability was found in Weaver E-Office 9.5 and classified as critical. Affected by this issue is some unknown functionality of the filCVE-2023-264707.5XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make the farm unusCVE-2023-264718.8XWiki Platform is a generic wiki platform. Starting in version 11.6-rc-1, comments are supposed to be executed with the right of superadmin CVE-2023-264728.8XWiki Platform is a generic wiki platform. Starting in version 6.2-milestone-1, one can execute any wiki content with the right of IconThemeCVE-2023-264736.5XWiki Platform is a generic wiki platform. Starting in version 1.3-rc-1, any user with edit right can execute arbitrary database select and CVE-2023-264748.8XWiki Platform is a generic wiki platform. Starting in version 13.10, it's possible to use the right of an existing document content author CVE-2023-264758.8XWiki Platform is a generic wiki platform. Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a r