Apache Log4j Vulnerability Allow Attackers to Intercept Sensitive Log Data

Apache Logging Services disclosed CVE-2025-68161: a missing TLS hostname verification in Log4j Core's Socket Appender (affecting 2.0-beta9 through 2.25.2) that can allow a man-in-the-middle with a trusted certificate to intercept or redirect sensitive logging traffic; Apache released Log4j 2.25.3 to fix the issue and recommends restricting trust stores as a mitigation for systems that cannot immediately upgrade.