The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when explicit verification attributes or system properties are enabled. As a result, an attacker who can intercept or redirect network traffic between the client and the log receiver can present a server certificate issued by a certificate authority trusted by the Socket Appender's trust store, and the stack will accept it without confirming the hostname. This allows the attacker to intercept, modify, or redirect log traffic, compromising confidentiality and integrity of log data. The flaw is an instance of missing hostname verification (CWE‑295) and certificate validation error (CWE‑297).

Affected software is the Apache Log4j Core library. Versions 2.0-beta9 to 2.25.2 inclusive are vulnerable. All deployments that use the Socket Appender to send logs via TLS over the network, whether they rely on the default Java trust store or a custom one, are impacted. No versions beyond 2.25.2 contain the fix.

The CVSS score of 6.3 indicates a moderate threat level. The EPSS score is below 1%, suggesting a low probability that the vulnerability will be actively exploited, and it is not listed in CISA's KEV catalog. However, the conditions required for exploitation—an attacker who can intercept the network flow—are plausible in many environments. The vulnerability is exploitable only when a trusted CA certificate can be presented to the Log4j Socket Appender, so it is most relevant to systems that connect to third‑party log collectors over TLS without restricting the trust store. Organizations should treat this as a low‑to‑moderate risk depending on exposure.