In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
id: CVE-2017-5645
info:
name: Apache Log4j Server - Deserialization Command Execution
author: p
...