org.apache.logging.log4j:log4j-coreMaven Central · Java

Verdict

Not enough signal to judge

We could not find enough public signal to judge org.apache.logging.log4j:log4j-core — no repository resolved from its registry metadata.

health 62/100

Why this verdict?

unknown — No repository resolved from the registry metadata, and no recent release either.

no repository resolved from registry metadata; last release 101 days ago

Judged 3 days ago from signal heuristics. How each verdict is decided

latest 2.26.1
last known licence Apache-2.0
assessment attempted 3 days ago
registry checked 19 days ago
registry ↗

Vulnerabilities, end of life and next steps

Check a specific version for known advisories, documented mitigations and evidence-backed earlier-version options. Maintenance health is separate from vulnerability status.

Review remediation options →

⚠ Known vulnerability history

Reference sources checked 2026-10-08; this is selected historical context, not a complete vulnerability scan.

These advisories relate to this package’s identity. We have not verified your installed version or deployment. This context is separate from its maintenance score.

CVE-2021-44228 · Log4Shell ↗

Applies to specific log4j-core releases, not log4j-api alone. Check resolved and bundled dependencies against Apache’s affected-version ranges.

How these vulnerabilities relate to package checks →

Maintenance trends

Loading historical repository activity…

Signals · last 21 checks

Commits 90d

—

Open issues

—

Unanswered

—

Contributors

—

What the project says about itself

Release lifecycle

The latest release, 2.26.1, is on the 2 line, with no end-of-life date scheduled.

Line	Released	Status	Latest
2	2014-07-12	supported	2.26.1
2.12	2019-06-26	end of life since 2021-12-14	2.12.4
2.3	2015-05-10	end of life since 2015-09-20	2.3.2
1	2001-01-08	end of life since 2015-10-15	1.2.17

Source: endoflife.date, from the project's release policy. Last collected: 2026-11-06T02:30:08.152Z. Browse product lifecycles →

Third-party facts checked 29 days ago; registry facts on every crawl.

State history 2

When	Change
2026-11-03	active → unknown
2026-09-29	first verdict: active

Badge

Drop this in your README. It re-renders itself as the verdict changes.

[![maintenance](https://isitdeadyet.dev/badge/maven/org.apache.logging.log4j:log4j-core.svg)](https://isitdeadyet.dev/maven/org.apache.logging.log4j:log4j-core)

Watch it

Get told when org.apache.logging.log4j:log4j-core changes state, changes licence, or is deprecated — instead of finding out during an incident.

Free for up to 25 packages. Signing in is a link sent to your email — there is no password to choose.