# Log4j in 2025: The Risks We Still Choose

*Log4Shell was downloaded nearly 40 million times this year; but it is just*  
*the tip of the iceberg with avoidable open source vulnerabilities.*

**2025 Monthly Log4Shell Download Rates by Country**

## The Avoidable Java Risks We’re Still Choosing

*Vulnerable Java components most frequently downloaded from Maven*  
*Central despite safe version availability*

| Component        | Safe Version                   | Download Rate | Vulnerabilities                                                             |
|------------------|-------------------------------|---------------|---------------------------------------------------------------------------|
| commons-compress  | Safe version 1.26 released February 2024 | 46.32%        | CVE-2012-2098, CVE-2024-26308, CVE-2020-1945, CVE-2024-25710, CVE-2021-36374 disclosed in version 1.21 |
| commons-lang     | Safe version 3.18.0 released July 2025  | 99.88%        | CVE-2025-48924 disclosed in version 2.6                                   |
| snappy           | Safe version 0.5 released May 2024       | 99.58%        | CVE-2024-36124 disclosed in version 0.4                                   |
| jdom2            | Safe version 2.0.6.1 released in December 2021 | 57.73%        | CVE-2021-33813 included in version 2.0.6                                    |