Log4j’s Security Blind Spot: New TLS Flaw Lets Attackers Intercept Sensitive Logs Despite Encryption

The Apache Software Foundation has released a security update for Log4j addressing a moderate-severity vulnerability, tracked as CVE-2025-68161, that could allow attackers to intercept sensitive log data in transit. The flaw affects the Socket Appender by bypassing TLS hostname verification, even when administrators enable it, effectively creating a security blind spot.

It lies in how Log4j Core handles secure connections when sending logs to a remote server, with versions 2.0-beta9 through 2.25.2 skipping the second verification step. According to Apache's advisory, the software does not perform TLS hostname verification of the peer certificate, which could enable a Man-in-the-Middle attack if an attacker positions themselves between the application and the log server.

The issue has been fixed in Core version 2.25.3, and users are advised to upgrade immediately; as a workaround, administrators can configure the Socket Appender to use a private or restricted trust root to limit trusted certificates.