log4j-patch

Non intrusive log4j2 RCE vulnerability patch.

Security & Privacy

Explore on GitHub Read Hacker News discussions

2Distinct people

2Mentions

0Explicit recommenders

65GitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

Non intrusive log4j2 RCE vulnerability patch.

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by 3-hour interval2 dated mentions

Observed mentions: 2021-12-10 04:50:10 UTC to 2021-12-11 13:05:23 UTC.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Comments
Dec 10, 03:00	2021-12-10 03:00:00 UTC	2021-12-10 06:00:00 UTC	1	1
Dec 10, 06:00	2021-12-10 06:00:00 UTC	2021-12-10 09:00:00 UTC	0	0
Dec 10, 09:00	2021-12-10 09:00:00 UTC	2021-12-10 12:00:00 UTC	0	0
Dec 10, 12:00	2021-12-10 12:00:00 UTC	2021-12-10 15:00:00 UTC	0	0
Dec 10, 15:00	2021-12-10 15:00:00 UTC	2021-12-10 18:00:00 UTC	0	0
Dec 10, 18:00	2021-12-10 18:00:00 UTC	2021-12-10 21:00:00 UTC	0	0
Dec 10, 21:00	2021-12-10 21:00:00 UTC	2021-12-11 00:00:00 UTC	0	0
Dec 11, 00:00	2021-12-11 00:00:00 UTC	2021-12-11 03:00:00 UTC	0	0
Dec 11, 03:00	2021-12-11 03:00:00 UTC	2021-12-11 06:00:00 UTC	0	0
Dec 11, 06:00	2021-12-11 06:00:00 UTC	2021-12-11 09:00:00 UTC	0	0
Dec 11, 09:00	2021-12-11 09:00:00 UTC	2021-12-11 12:00:00 UTC	0	0
Dec 11, 12:00	2021-12-11 12:00:00 UTC	2021-12-11 15:00:00 UTC	1	1

What Hacker News says

2 sources

phgr100x·Dec 11, 2021

https://github.com/Glavo/log4j-patch This is a non-intrusive patch that allows you to block this vulnerability without modifying the program code/updating the dependent. So you can use it to patch third-party programs, such as Minecraft. The principle of the library is simple: It provides an empty JndiLookup to override the implementation in log4j. Log4j2 can handle this situation and safely disable JNDI lookup. It is compatible with all versions of log4j2 (2.0~2.15).

In Log4j RCE Found

nightpool·Dec 10, 2021

Note that the formatMsgNoLookups workaround only applies to recent versions of the log4j library, while it's still unclear how far back this bug may stretch. Other options for patching are detailed in the thread: https://github.com/apache/logging-log4j2/pull/608#issuecomme... mentions that just removing the class providing the vulnerable behavior works well, and https://github.com/Glavo/log4j-patch is a JAR that you can add to your classpath to simply override the same class. See https://github.com/apache/logging-log4j2/pull/608#issuecomme... for more details.

In Log4j RCE Found