Question: Log4j version support matrix for OpenSearch 3.4 (2.21.0 vs 2.25.x) #20455
Description
Describe the bug
Description
We upgraded OpenSearch to version 3.4 (RPM, Java 21).
The OpenSearch 3.4 RPM still ships with Apache Log4j 2.21.0:
- log4j-api-2.21.0.jar
- log4j-core-2.21.0.jar
- log4j-jul-2.21.0.jar
- log4j-slf4j-impl-2.21.0.jar (including plugins)
Security scanners are recommending Log4j 2.25.3 or later.
However, manually upgrading Log4j beyond 2.21.x causes startup failures and plugin incompatibilities.
Environment
- OpenSearch version: 3.4.x (RPM)
- OS: Rocky Linux
- Java: OpenSearch bundled JDK (Java 21)
- Security plugin: Enabled
- Plugins: ML, Security, Notifications
Evidence
Output from RPM:
Related component
No response
To Reproduce
- Go to '...'
- Click on '....'
- Scroll down to '....'
- See error
Expected behavior
Confirmation of the officially supported Apache Log4j version for OpenSearch 3.4,
and clear guidance on whether Log4j versions newer than 2.21.0 are supported
or planned, especially in the context of security scanner recommendations.
Additional Details
Plugins
Please list all plugins currently enabled.
Screenshots
If applicable, add screenshots to help explain your problem.
Host/Environment (please complete the following information):
- OS: [e.g. iOS]
- Version [e.g. 22]
Additional context
Add any other context about the problem here.