GitHub user fs523577192 created a discussion: Any plan or schedule for the next version?
The latest version 2.26.1 has been flagged by Sonatype to have 9.2 critical vulnerability [sonatype-2026-006746](https://guide.sonatype.com/vulnerability/sonatype-2026-006746) for more than 2 months (as of today 02 Nov 2026). It seems that "vulnerability" is fixed in https://github.com/apache/logging-log4j2/pull/4365 and https://github.com/apache/logging-log4j2/pull/4274. May I know whether there is any plan or schedule to release it (in the next version)? Although it is not a CVE and I believe most of the application will not pass untrusted object into Log4j ObjectMessage, ObjectArrayMessage, etc. and let Log4j deserialize it, our company's security policy demands us to get rid of it. And it will take much time and effort for us to prove that this "vulnerability" is not expoitable in our applications and for the security team to review our evidences. It will save our lives if we can upgrade to a new version without this sonatype-2026-006746. GitHub link: https://github.com/apache/logging-log4j2/discussions/4451 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected]
