Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

Apache Log4j2 versions 2.15.0 have an incomplete fix that allows attackers to exploit Thread Context data in non-default logging configurations to leak information or execute malicious code. This affects systems using specific logging patterns that weren't properly secured in the initial patch.

CVE-2021-45046 is a follow-up to CVE-2021-44228 affecting Log4j 2.15.0 when non-default Pattern Layouts include Context Lookup or Thread Context Map patterns (e.g., ${ctx:*} or %X). Attackers with control over MDC input can inject JNDI Lookup patterns to achieve remote code execution (RCE) in certain environments or local code execution universally. The vulnerability requires logging configuration with specific pattern components and is mitigated in Log4j 2.16.0+ and 2.12.2+ by disabling JNDI by default and removing message lookup support.