Skip to content

Correct historical context of deserialization FAQ #43

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ppkarwasz merged 2 commits into from
Aug 27, 2026
+7 −2
Merged

Correct historical context of deserialization FAQ #43

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7e08255
Correct historical context of deserialization FAQ
ppkarwasz Aug 27, 2026
dc163d6
Merge branch 'main' into fix-deserialization-historical-context
ppkarwasz Aug 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions src/site/antora/modules/ROOT/pages/security/faq.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,9 +208,14 @@ Log4j provides **no guarantee** that deserializing a stream containing its class

Log4j 1 shipped a `SocketServer` and a `SocketAppender` that exchanged log events over the network using Java serialization.

In Log4j 2:
Log4j 2 inherited this functionality: up to and including the 2.8.x releases, `log4j-core` contained TCP and UDP socket servers (`TcpSocketServer` and `UdpSocketServer`) that received serialized log events from other applications.
As with any endpoint that consumes serialized data from the network, these servers were dangerous to operate and resulted in xref:security.adoc#CVE-2017-5645[CVE-2017-5645].

* The `SocketServer` receiver was never reintroduced into the production codebase.
The vulnerability was patched in version `2.8.2` by introducing `FilteredObjectInputStream`, an allowlist-based equivalent for Java 7 of the `ObjectInputFilter` API introduced in Java 9.
Since this fix could not cover all cases, the socket servers were removed entirely in the next release, `2.9.0`.
Since then:

* No socket server has ever been reintroduced into the production codebase.
* `SerializedLayout`, originally provided for Log4j 1 compatibility, has been **deprecated since version 2.9** and should not be used.
See the {site-url}/log4j/2.x/manual/layouts.html#SerializedLayout[SerializedLayout documentation] for details.
* Several Log4j 2 classes, most notably `Logger`, `Message` and `LogEvent`, remain `Serializable` for backward compatibility.
Expand Down
Loading