Minecraft Java Log4j RCE 0-Day Vulnerability

On the 9th of October 2021, a zero-day exploit affecting Minecraft Java servers and clients using versions 1.7 to 1.18.1 was discovered. This allows malicious users to execute commands on your server without needing to be an operator, through methods such as chat, which can affect your client as well.

Mojang has released a client-sided fix that will be automatically applied by restarting your launcher. Servers however, need to be updated to the latest version, or manually secured. You can find a list of server type versions we have patched so far, or ways to secure your server type below.

# Patched Versions

The following versions have been secured and are safe to play as normal (Note: These are only safe to play if selected from our panel. Using custom jars may not be protected).

• Bungeecord
• Paper Waterfall
• Paper Velocity (Using the latest version of the official website)
• CraftBukkit 1.18.2
• Fabric 1.18.2
• Fabric 1.18
• Fabric 1.17.1
• Fabric 1.17
• Fabric 1.16.5
• Fabric 1.16.4
• Forge 1.18.2
• Forge 1.18
• Forge 1.17.1
• Forge 1.16.5
• Forge 1.15.2
• Forge 1.14.4
• Forge 1.13.2
• Forge 1.12.2
• Forge 1.10.2
• Forge 1.8.9
• Forge 1.7.10
• Paper 1.18.2
• Paper 1.18.1
• Paper 1.18
• Paper 1.17.1
• Paper 1.16.5
• Paper 1.15.2
• Paper 1.14.4
• Paper 1.13.2
• Paper 1.12.2
• Paper 1.10.2
• Spigot 1.18.2
• Spigot 1.18.1
• Spigot 1.18
• Spigot 1.17.1
• Spigot 1.17
• Spigot 1.16.5
• Spigot 1.15.2
• Spigot 1.14.4
• Spigot 1.13.2
• Spigot 1.12.2
• Spigot 1.11.2
• Spigot 1.10.2
• Spigot 1.9.4
• Spigot 1.8.8
• Vanilla 1.7 - 1.18.2

# Unpatched Versions

• CraftBukkit 1.7-1.18
• Custom Jar: Check the current patch status of the server jar you are using and follow the developer's instructions where needed.
• Spigot 1.17
• Spigot 1.16-1.16.4
• Spigot 1.15-1.15.1
• Spigot 1.14-1.14.3
• Spigot 1.13-1.13.1
• Spigot 1.12-1.12.1
• Spigot 1.11-1.11.1
• Spigot 1.10-1.10.1
• Spigot 1.9-1.9.3
• Spigot 1.8-1.8.7
• Spigot 1.7-1.7.10