Log4j and the Comedy of Errors: Millions Still Downloading Vulnerable Versions!
Log4Shell vulnerability continues to haunt developers, with 13% of Log4j downloads still risky in 2025. Despite available fixes, developers opt for popularity over security, creating a classic case of ‘corrosive risk.’ Sonatype urges a shift to prioritizing security, automating upgrades, and blocking known vulnerabilities to eliminate unnecessary risk.
Hot Take:
Log4j strikes again, proving that when it comes to software vulnerabilities, the only thing spreading faster than a malware is developers’ reluctance to update!
Key Points:
- In 2025, 13% of Log4j downloads were still vulnerable to Log4Shell, showcasing persistent risks in open source.
- India, China, and Japan top the charts with the highest shares of vulnerable Log4j downloads.
- Sonatype highlights the corrosive risk of vulnerabilities that have fixes but remain unpatched.
- 95% of vulnerable component downloads have safer versions available, yet developers often ignore them.
- Developers’ reliance on outdated libraries is fueled by “set-and-forget” habits and flawed selection criteria.
Already a member? Log in here