Complete end-of-life dates, support windows, and security status for all Log4j versions. Data sourced from endoflife.date and official vendor documentation. Updated at every deploy.
✓Log4j 2.25.4 is actively supported. No versions approaching EOL in the next 6 months.
Latest Active
2.25.4
2 series
Next EOL
—
None upcoming
Active Versions
1
of 4 total
EOL Versions
3
no longer patched
Release Cycle Timeline
■ EOL
■ Warning
■ Active
┊ Today
All Versions
Version
Latest Release
Release Date
EOL Date
Days
Status
1
1.2.17
Jan 8, 2001
Oct 15, 2015
3859 days past EOL
EOL
2.3
2.3.2
May 10, 2015
Sep 20, 2015
3884 days past EOL
EOL
2.12
2.12.4
Jun 26, 2019
Dec 14, 2021
1607 days past EOL
EOL
2
2.25.4
Jul 12, 2014
Already EOL
Supported
Active
What does Log4j end of life mean for your organization?
When a Log4j version reaches end of life, the maintainers stop issuing security patches. Vulnerabilities discovered after this date are publicly disclosed on the National Vulnerability Database, exploit code appears on GitHub, and your systems remain permanently exposed.
The CVE blind spot: Most vulnerability scanners check for known CVEs but do not flag the accumulation of unpatched vulnerabilities in EOL software. With a zero-day, nobody knows about the vulnerability. With EOL software, the vulnerability is public — listed, rated, and often weaponized — but no patch will ever exist. This is the most dangerous gap in enterprise security posture.
Organizations running EOL Log4j should treat it as a vulnerability class in their risk register, apply compensating controls (network segmentation, enhanced monitoring, access restriction), and prioritize migration to a supported version.
Check your full stack for EOL risk
Upload requirements.txt, package.json, or Gemfile — full EOL report instantly.
See the full table above for all Log4j version EOL dates.
What is the latest supported version of Log4j?
The latest active version of Log4j is 2.25.4. Always verify against the table above as support windows can change.
What happens when Log4j reaches end of life?
When Log4j reaches end of life, the vendor stops issuing security patches. Any CVEs disclosed after the EOL date accumulate indefinitely with no patch path — creating an ever-growing attack surface that most vulnerability scanners do not flag.
How do I check if I'm running an EOL version of Log4j?
Check your current version against the table above. If your version's EOL date has passed, you are running unsupported software. You can also use the endoflife.ai Stack Scanner to check your entire dependency file at once.
Is there extended support available for EOL Log4j versions?
Some vendors offer extended support for EOL software. Contact the original vendor or check with enterprise support providers for options.