The Apache Log4j Core SocketAppender fails to verify the TLS hostname on peer certificates — a subtle but important omission that can allow a man‑in‑the‑middle to intercept or redirect log traffic when certain conditions are met. Apache has fixed the flaw in Log4j Core 2.25.3 and published a...
