Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be…

Description

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1

Scores

EPSS (exploitation in 30 days)

8.2% · top 5.1% of all CVEs (5 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.7.

Weakness

• Improper Validation of Certificate with Host Mismatch
• CWE-295 Improper Certificate Validation (opens in a new tab)All about CWE-295 and its CVEs

Affected products

• Apache · Apache Log4j

  • affected log4j-core 2.13.0
  • affected log4j-core – < 2.12.3

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenorg.apache.logging.log4j:log4jGHSA-vwqq-5vrc-xw9h (opens in a new tab)
• Mavenorg.apache.logging.log4j:log4j-coreGHSA-vwqq-5vrc-xw9h (opens in a new tab)

References (49)

• [zookeeper-issues] 20200504 [jira] [Created] (ZOOKEEPER-3817) owasp failing due to CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-dev] 20200504 [jira] [Created] (ZOOKEEPER-3817) owasp failing due to CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-notifications] 20200504 Build failed in Jenkins: zookeeper-master-maven-owasp #489 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-issues] 20200504 [jira] [Assigned] (ZOOKEEPER-3817) owasp failing due to CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-issues] 20200504 [jira] [Commented] (ZOOKEEPER-3817) owasp failing due to CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-dev] 20200504 log4j SmtpAppender related CVE (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-notifications] 20200504 [GitHub] [zookeeper] symat opened a new pull request #1346: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-issues] 20200504 [jira] [Updated] (ZOOKEEPER-3817) owasp failing due to CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-commits] 20200504 [zookeeper] branch master updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-commits] 20200504 [zookeeper] branch branch-3.5 updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-commits] 20200504 [zookeeper] branch branch-3.6 updated: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-issues] 20200504 [jira] [Resolved] (ZOOKEEPER-3817) owasp failing due to CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [zookeeper-notifications] 20200504 [GitHub] [zookeeper] symat commented on pull request #1346: ZOOKEEPER-3817: suppress log4j SmtpAppender related CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [kafka-dev] 20200514 [jira] [Created] (KAFKA-9996) upgrade zookeeper to 3.5.8 to address security vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [kafka-jira] 20200514 [jira] [Created] (KAFKA-9996) upgrade zookeeper to 3.5.8 to address security vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [kafka-dev] 20200514 [jira] [Created] (KAFKA-9997) upgrade log4j lib to address CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [kafka-jira] 20200514 [jira] [Created] (KAFKA-9997) upgrade log4j lib to address CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [kafka-jira] 20200515 [jira] [Commented] (KAFKA-9997) upgrade log4j lib to address CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/security-alerts/cpujul2020.html (opens in a new tab)x_refsource_MISCx_transferred
• https://issues.apache.org/jira/browse/LOG4J2-2819 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://security.netapp.com/advisory/ntap-20200504-0003/ (opens in a new tab)x_refsource_CONFIRMx_transferred
• [db-torque-dev] 20200715 Build failed in Jenkins: Torque4-trunk #685 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/security-alerts/cpuoct2020.html (opens in a new tab)x_refsource_MISCx_transferred
• [hive-issues] 20201207 [jira] [Work started] (HIVE-24500) Hive - upgrade log4j 2.12.1 to 2.13.2+ due to CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hive-issues] 20201207 [jira] [Assigned] (HIVE-24500) Hive - upgrade log4j 2.12.1 to 2.13.2+ due to CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hive-issues] 20201207 [jira] [Updated] (HIVE-24500) Hive - upgrade log4j 2.12.1 to 2.13.2+ due to CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hive-dev] 20201207 [jira] [Created] (HIVE-24500) Hive - upgrade log4j 2.12.1 to 2.13.2+ due to CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hive-issues] 20201208 [jira] [Work logged] (HIVE-24500) Hive - upgrade log4j 2.12.1 to 2.13.2+ due to CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hive-issues] 20201208 [jira] [Updated] (HIVE-24500) Hive - upgrade log4j 2.12.1 to 2.13.2+ due to CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/security-alerts/cpujan2021.html (opens in a new tab)x_refsource_MISCx_transferred
• https://lists.apache.org/thread.html/re024d86dffa72ad800f2848d0c77ed93f0b78ee808350b477a6ed987%40%3Cgitbox.hive.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• https://lists.apache.org/thread.html/rbc7642b9800249553f13457e46b813bea1aec99d2bc9106510e00ff3%40%3Ctorque-dev.db.apache.org%3E (opens in a new tab)x_refsource_MISCx_transferred
• [hive-issues] 20210125 [jira] [Work logged] (HIVE-24500) Hive - upgrade log4j 2.12.1 to 2.13.2+ due to CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [db-torque-dev] 20210127 Re: Items for our (delayed) quarterly report to the board? (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [db-torque-dev] 20210128 Antwort: Re: Items for our (delayed) quarterly report to the board? (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hive-issues] 20210209 [jira] [Resolved] (HIVE-24500) Hive - upgrade log4j 2.12.1 to 2.13.2+ due to CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hive-dev] 20210216 [jira] [Created] (HIVE-24787) Hive - upgrade log4j 2.12.1 to 2.13.2+ due to CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hive-issues] 20210216 [jira] [Resolved] (HIVE-24787) Hive - upgrade log4j 2.12.1 to 2.13.2+ due to CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hive-issues] 20210216 [jira] [Assigned] (HIVE-24787) Hive - upgrade log4j 2.12.1 to 2.13.2+ due to CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [hive-issues] 20210218 [jira] [Updated] (HIVE-24787) Hive - upgrade log4j 2.12.1 to 2.13.2+ due to CVE-2020-9488 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [flink-issues] 20210510 [GitHub] [flink] zentol opened a new pull request #15879: [FLINK-22407][build] Bump log4j to 2.24.1 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/security-alerts/cpuApr2021.html (opens in a new tab)x_refsource_MISCx_transferred
• [kafka-users] 20210617 vulnerabilities (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/security-alerts/cpuoct2021.html (opens in a new tab)x_refsource_MISCx_transferred
• DSA-5020 (opens in a new tab)vendor-advisoryx_refsource_DEBIANx_transferred
• [debian-lts-announce] 20211226 [SECURITY] [DLA 2852-1] apache-log4j2 security update (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/security-alerts/cpuapr2022.html (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-vwqq-5vrc-xw9h (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2020-9488](https://trackcve.app/badge/CVE-2020-9488.svg)](https://trackcve.app/cve/CVE-2020-9488)

Record last updated 29 May 2026, 16:07 UTC.