# Cybereason/Logout4Shell

Use Log4Shell vulnerability to vaccinate a victim server against Log4Shell

Repository: https://github.com/Cybereason/Logout4Shell
Canonical: https://ross.abutalabs.com/products/logout4shell
Language: Java
License: MIT
License Family: permissive
Last push: 2021-12-22T02:02:58+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 1727, "days_push": 1716, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1692, forks 106 (observed 2026-08-28T04:05:22.678544+00:00)

## What it is
A Java-based proof-of-concept tool by Cybereason that exploits the Log4Shell vulnerability (CVE-2021-44228) to 'vaccinate' a vulnerable server, setting formatMsgNoLookups to true and removing the JNDI Interpolator to block further exploitation. It supports Log4j versions 2.0 through 2.14.1 and is intended as an emergency mitigation when patching is not immediately possible.

## Use cases
- mitigate log4shell on a server i can't restart
- emergency fix for cve-2021-44228 before patching
- vaccinate a vulnerable log4j server remotely
- disable jndi lookups in log4j without a restart
- stop log4shell exploitation attempts on my java server

## When to choose
- you need an immediate stopgap mitigation for Log4Shell on servers you cannot immediately patch or restart
- you are running Log4j 2.0-2.14.1 and need to disable JNDI lookups remotely

## When to avoid
- you can simply upgrade Log4j to 2.17.0 or later - patching is the proper fix
- you need a supported, production-grade security tool rather than a proof of concept
- your Log4j version is outside the 2.0-2.14.1 supported range

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: security, vulnerability-scanning
- domain: security, backend, developer-tools
- platform: jvm, cross-platform
- tags: log4shell, cve-2021-44228, mitigation, vaccination, proof-of-concept

## Member repositories
- Cybereason/Logout4Shell (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:05:22.678544+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T03:38:12.670248+00:00, confidence not recorded.
  - readme: https://github.com/Cybereason/Logout4Shell (fetched 2026-08-28T04:05:22.678544+00:00, sha 33b2572c48d3)
- Data as of 2026-08-30T08:39:29.467469+00:00.