In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary…

{
                    "product": "Apache Log4j",
                    "vendor": "Apache Software Foundation",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "All versions between 2.0-alpha1 and 2.8.1"
                        }
                    ]
                }