Log4Shell
December 2021 remote-code-execution flaw in the Apache Log4j Java logging library.
Log4Shell, the December 2021 remote-code-execution flaw in Apache Log4j, is the reference case behind the EU Cyber Resilience Act's 24-hour reporting duty, which began enforcing on 11 September 2026.
Last refreshed: 22 September 2026
Timeline for Log4Shell
Cyber Resilience Act starts its clock
European Tech SovereigntyMentioned in: EU backs open source with €2bn plan
European Tech SovereigntyBackground
Log4Shell (CVE-2021-44228) is a critical remote-code-execution vulnerability disclosed in December 2021 in Apache Log4j, a widely embedded Java logging library. Because Log4j sits inside thousands of downstream products rather than being sold directly, the flaw became a reference case for software supply-chain risk and for regulation that puts reporting duties on manufacturers rather than on the open-source maintainers whose code those products embed.
It is the worked example behind the EU Cyber Resilience Act's incident-reporting duty. Lowdown's coverage of the Act's 11 September 2026 reporting start cites Log4Shell as the gap that duty closes: a flaw sat inside thousands of commercial products for months and no law required anyone to tell EU authorities quickly.
What was Log4Shell?
Why does the Cyber Resilience Act matter after Log4Shell?
Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 22 September 2026. Editorial standards.