Skip to content


Repository files navigation


This is a tool which injects a Java agent into a running JVM process. The agent will attempt to patch the lookup() method of all loaded org.apache.logging.log4j.core.lookup.JndiLookup instances to unconditionally return the string "Patched JndiLookup::lookup()". It is designed to address the CVE-2021-44228 remote code execution vulnerability in Log4j without restarting the Java process. This tool will also address CVE-2021-45046.

This has been currently only tested with JDK 8, 11, 15 and 17 on Linux!



To build on linux, mac and Windows subsystem for linux

./gradlew build

To build on Windows

.\gradlew.bat build

Depending on the platform you are building. This will generate build/libs/Log4jHotPatch.jar


To build using Maven use

mvn clean package

This will generate a target/Log4jHotPatch.jar.



java -cp <java-home>/lib/tools.jar:Log4jHotPatch.jar Log4jHotPatch <java-pid>

JDK 11 and newer

java -jar Log4jHotPatch.jar <java-pid>

Running the static agent

Simply add the agent to your java command line as follows:

java -classpath <class-path> -javaagent:Log4jHotPatch.jar <main-class> <arguments>

Testing the agent

There are a set of tests that can be run outside Gradle or Maven.

build-tools/bin/ Log4jHotPatch.jar <JDK_ROOT>

Known issues

If you get an error like:

Exception in thread "main" The VM does not support the attach mechanism
	at jdk.attach/
	at jdk.attach/
	at jdk.attach/
	at Log4jHotPatch.loadInstrumentationAgent(
	at Log4jHotPatch.main(

this means that your JVM is refusing any kind of help because it is running with -XX:+DisableAttachMechanism.

If you get an error like: Unable to open socket file: target process not responding or HotSpot VM not loaded
	at Log4jHotPatch.loadInstrumentationAgent(
	at Log4jHotPatch.main(

this means you're running as a different user (including root) than the target JVM. JDK 8 can't handle patching as root user (and triggers a thread dump in the target JVM which is harmless). In JDK 11 patching a non-root process from a root process works just fine.

If you get an error like this in the target process:

Exception in thread "Attach Listener" java.lang.ExceptionInInitializerError
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(
        at java.lang.reflect.Method.invoke(
        at sun.instrument.InstrumentationImpl.loadClassAndStartAgent(
        at sun.instrument.InstrumentationImpl.loadClassAndCallAgentmain(
Caused by: access denied ("java.util.PropertyPermission" "log4jFixerAgentVersion" "write")
        at java.lang.SecurityManager.checkPermission(
        at java.lang.System.setProperty(
        at Log4jHotPatch.<clinit>(

it means the target process has a security manager installed. Look for this command line option in the target process:

If you encounter this error, make sure you are using the latest version of the tool

Important: If you attempted to patch as the wrong user, you may need to delete .attach_pid<pid> files (found in /tmp and/or the CWD of the VM process) before trying again. These files need to have the right ownership for attach to succeed.


An agent to hotpatch the log4j RCE from CVE-2021-44228.



Code of conduct

Security policy





No packages published