Is log4j-core 2.14.1 vulnerable to Log4Shell, and which version fixes it?

Answered byPackage Vulnerability Check API: CVEs, CISA KEV, safe upgrade

Price$0.005 per package version or CVE answered (HTTP API)

StatusOn the HTTP API

Yes. OSV.dev lists log4j-core 2.14.1 as affected by CVE-2021-44228 (Log4Shell, CVSS 10, in CISA's Known Exploited Vulnerabilities catalog) and several later Log4j advisories. The row gives vulnerability_count, max_severity, known_exploited and safe_version, the lowest version that fixes every listed advisory, with a source_url per advisory.

Tool input

{
  "ecosystem": "Maven",
  "name": "org.apache.logging.log4j:log4j-core",
  "version": "2.14.1"
}

Ask it from an AI agent (MCP)

Add the Apify MCP server with this tool to your MCP client (Claude, Cursor, VS Code, ...); it signs you in with OAuth or Authorization: Bearer <APIFY_TOKEN>. It works once the Actor is listed on the Apify Store; until then use the HTTP API or the remote MCP server at https://api.boscolabs.dev/mcp.

https://mcp.apify.com?tools=bosco_labs/package-vulns

Then ask:

Use the bosco_labs/package-vulns tool to answer: Is log4j-core 2.14.1 vulnerable to Log4Shell, and which version fixes it?

Call the Apify API

Runs the Actor and returns the rows in one request, billed to your Apify account ($0.005 per package version or CVE answered (HTTP API)). It works once the Actor is listed on the Apify Store; until then use the HTTP API or the remote MCP server at https://api.boscolabs.dev/mcp.

curl https://api.apify.com/v2/acts/bosco_labs~package-vulns/run-sync-get-dataset-items \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "version": "2.14.1"}'

Call the Bosco Labs HTTP API

Bosco Labs HTTP API (beta): same input and rows, $0.005 per package version or CVE answered from prepaid credits. Get a key with a $0.50 free trial, or send the same call without a key and pay per call in USDC via x402 (no account).

curl https://api.boscolabs.dev/v1/package-vulns \
  -H "Authorization: Bearer $BOSCO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"ecosystem": "Maven", "name": "org.apache.logging.log4j:log4j-core", "version": "2.14.1"}'

Example output

Snapshot taken 2026-11-06, source links in each row. First 1 of 1 rows (snapshot runs stop at 5 rows); long values shortened.

[
  {
    "schema_version": "1",
    "query_type": "package",
    "ecosystem": "Maven",
    "name": "org.apache.logging.log4j:log4j-core",
    "version": "2.14.1",
    "vulnerability_id": null,
    "summary": "Maven org.apache.logging.log4j:log4j-core 2.14.1: 8 known vulnerabilities (max severity CRITICAL), IN CISA KEV (known exploited); safe version: 2.25.4.",
    "vulnerability_count": 8,
    "known_exploited": true,
    "max_severity": "CRITICAL",
    "safe_version": "2.25.4",
    "safe_version_note": "2.25.4 is the lowest version above 2.14.1 among the advisories' fixed versions with no known vulnerability in OSV.dev (checked with OSV, not a release-list s...",
    "epss": null,
    "nvd": null,
    "...": "6 more fields"
  }
]

Call it on the HTTP API →All fields and limits