When Apache Log4j goes EOL, the CVEs don't stop.
Supported Versions: 1.2.x, 2.17.x, 2.18.x
Apache stopped patching Log4j 1.x in 2015 and Log4j 2.17–2.18 in 2022. Never-Ending Support for Apache Log4j keeps these versions you already run secure, compliant and audit-ready after upstream stops shipping patches. No migration, no code changes, no new version to adopt.
TRUSTED BY ENTERPRISE
Security, compliance, and continuity -- solved together
With a secure drop-in replacement for end-of-life versions of Apache Log4j, your scanners stop flagging Log4j CVEs for good.
Security
A new release ships each time a Log4j CVE is found, validated, and fixed on versions Apache no longer patches, developed by engineers with core-maintainer expertise in this stack.
SLA-backed patch delivery tied to severity
HeroDevs is an authorized CVE Numbering Authority that discloses discovered vulnerabilities
Compliance
Once installed, scanners stop flagging Log4j CVEs because the library is actively patched and commercially supported, turning open audit findings into closed ones.
SOC 2, PCI DSS, HIPAA, FedRAMP, ISO 27001, NIS2 and more
Documented patch history for auditors
Business continuity
A true drop-in: same Maven coordinates, same build and CI/CD workflow, no application code changes. The framework or platform that pinned Log4j can be addressed in the right order.
Months or years of runway to migrate right
A fraction of migration cost or the cost of a breach.
Log4j 1
Apache declared Log4j 1.x end of life on August 5, 2015. No upstream fixes have shipped since 1.2.17, and the vulnerabilities disclosed after that date remain open in the final Apache release.
Log4j 2
Apache maintains Log4j 2 on its current release line only. The 2.17 and 2.18 lines reached end of maintenance in June and September 2022, so applications pinned to them receive none of the fixes that ship in current Log4j 2 releases.
Every patch we ship has a published CVE entry
HeroDevs is an authorized CVE Numbering Authority (CNA), empowered by the CVE Program to discover and assign CVE IDs to security vulnerabilities discovered by HeroDevs.
Every NES for Apache Log4j release ships with HeroDevs VEX statements, one per CVE, naming the exact artifact and version that carries the fix.
If you're running legacy Apache Log4j versions today, your applications may be exposed. NES for Apache Log4j installs in minutes..
What NES for Apache Log4j 2 publishes
Every org.apache.logging.log4j module upstream published for 2.17.2 and 2.18.0 is published under the NES coordinates.
Core
log4j-api
log4j-core
log4j-bom
Layouts and compatibility
log4j-layout-template-json
log4j-1.2-api
log4j-slf4j-impl
log4j-to-slf4j
log4j-jul
log4j-jcl
Integration
log4j-spring-boot
log4j-spring-cloud-config-client
log4j-web
log4j-jakarta-web
log4j-appserver
log4j-jdbc-dbcp2
A defensible answer for every standard, framework, or regulation.
EOL software undermines patch-management expectations across regulations worldwide. NES gives you a maintained, vendor-backed build with committed SLAs and a documented patch history to demonstrate compliance to auditors and regulators.
PCI DSS
Req. 6.3.3 requires known critical and high-severity vulnerabilities to be patched within 30 days. EOL Apache Log4j with no upstream patch puts you out of compliance. NES restores the patch path.
HIPAA
Unsupported frameworks make it hard to show reasonable safeguards for systems handling ePHI. NES provides active maintenance and risk reduction.
SOC 2
Trust Services Criteria expect timely vulnerability remediation and patch management. EOL dependencies raise material findings during audit unless a compensating support path exists. NES is that support path.
NIS2
Article 21 covers patching, vulnerability, and supply-chain management. Running EOL software without a maintained support path creates risk that NIS2 expects operators to actively mitigate.
DORA
DORA treats EOL software as a resilience gap for financial ICT assets. NES gives you a maintained build and a documented patch-management program.
Cyber Resilience Act
Governs software lifecycle security for products with digital elements. NES gives you a maintained, patched build for your EOL Apache Log4j line during the coverage period.
NIST CSF 2.0
Control PR.PS-02 requires organizations to actively maintain or remove vulnerable software based on risk. NES enables compliance without a forced upgrade.
FedRAMP
Continuous monitoring expects flaw remediation on a defined cadence. A patched, vendor-backed build gives your ISSO the documented remediation path to justify keeping EOL Apache Log4j in the authorization boundary.
Commercial Contracts
Vulnerability and configuration management controls require identifying technical vulnerabilities and keeping software within secure standards. NES restores that posture for EOL software.
We Partner With Core Contributors
We collaborate with open-source engineers and ecosystem contributors to ensure our Never-Ending Support products are the same quality you've come to expect from the originals.
By involving engineers with deep project expertise, we set a new standard in open-source software maintenance to ensure that NES for Log4j is as dependable as the upstream technology it's built on.
We Give Back to Open Source
Open source maintainers do critical work, but rarely get paid for it.
HeroDevs is putting $20 million toward changing that — funding the creators and projects that keep the ecosystem running, with grants from $2,500 to $250,000.
We’ve written patches for unmaintained codebases, tracked down vulnerabilities where no one else was looking, and kept critical systems running safely without rushed rewrites. This fund builds on that work, so maintainers can keep doing what they do best.
Frequently Asked Questions
Contact Us
Got questions about Never-Ending Support for your open-source library? We're here to help!
Discover how HeroDevs NES Products can keep your systems secure and compliant.
Learn how our solutions can deliver value to your organization.
Get detailed pricing information tailored to your needs.
Resources
View All Articles
