Log4Shell Infographic copy - RV8
Log4j in 2025: The Risks We Still Choose
Log4Shell was downloaded nearly 40 million times this year; but it is just
the tip of the iceberg with avoidable open source vulnerabilities.
2025 Monthly Log4Shell Download Rates by Country
The Avoidable Java Risks We’re Still Choosing
Vulnerable Java components most frequently downloaded from Maven
Central despite safe version availability
| Component | Safe Version | Download Rate | Vulnerabilities |
|---|---|---|---|
| commons-compress | Safe version 1.26 released February 2024 | 46.32% | CVE-2012-2098, CVE-2024-26308, CVE-2020-1945, CVE-2024-25710, CVE-2021-36374 disclosed in version 1.21 |
| commons-lang | Safe version 3.18.0 released July 2025 | 99.88% | CVE-2025-48924 disclosed in version 2.6 |
| snappy | Safe version 0.5 released May 2024 | 99.58% | CVE-2024-36124 disclosed in version 0.4 |
| jdom2 | Safe version 2.0.6.1 released in December 2021 | 57.73% | CVE-2021-33813 included in version 2.0.6 |