Apache says application developers need to update Log4j libraries to version 2.17 to ensure that recursive lookups do not cause services to fail through a distributed-denial-of-service attack.

Apache can’t seem to catch a break with Java-based logging utility Log4j, as a third major vulnerability has now been discovered.

A second vulnerability involving Apache Log4j was found on Tuesday after cybersecurity experts spent days attempting to patch or mitigate CVE-2021-44228. The description of the new vulnerability ...