OMENWAVE modelled vulnerability-chaining pathways

CVE-2021-45105

Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.

5.9

CVSS Medium

100.0%

EPSS p100

In CISA KEV

Data as of 2 Nov 2026 · NVD, CISA KEV, EPSS

Why chaining, at machine speed

Defenders still triage vulnerabilities one CVE at a time, while increasingly automated attackers combine them at machine speed. Omenwave models the plausible pathways by which this CVE could be chained with others — surfacing them for research and awareness, with evidence for each step.

Modelled capability profile

Kill-chain stage: IMPACT
Requires: NONE access, NETWORK vector
Grants: NONE access (terminal impact)
Capabilities: denial of service
Model confidence: high · CVSS 3.1

Top plausible next hops

No plausible forward hops are modelled from this CVE in the current corpus (it may be a terminal impact, or an independent entry point rather than a continuation).

Open in the interactive explorer →

Embed this snapshot

Paste this into a blog post or report — it renders a compact, exploit-free chain snapshot.

<iframe src="https://omenwave.com/embed/CVE-2021-45105" width="560" height="320" style="border:0" loading="lazy" title="Omenwave — CVE-2021-45105 modelled chaining"></iframe>

Modelled plausible chaining potential derived from public CVE metadata (CVSS, CWE, CPE). Not a confirmed real-world exploit chain and contains no exploitation detail. For research and awareness only.

Methodology · Interactive explorer · JSON: /cve/CVE-2021-45105