Minecraft Java Edition was the first widely publicised target of Log4Shell (CVE-2021-44228). Many small self-hosted servers still run an unpatched release. If you host one, the fix is straightforward. Identify your build, apply the official patch, and verify that no plugin or mod bundles an unpatched copy of Log4j. No exploit details here. Only defensive checks and fixes.

Which Minecraft Versions Are Affected

Log4Shell hits any Minecraft Java server that uses a susceptible Log4j library and processes chat messages. The attack vector was a chat message containing a JNDI lookup string that the server logged. Releases below 1.7 are not affected. Minecraft: Bedrock Edition is not affected, because it is not written in Java.

For Java Edition, these releases are at risk unless patched:

  • 1.7 through 1.11.2
  • 1.12 through 1.16.5
  • 1.17, every build before 1.17.1
  • 1.18, every build before 1.18.1

Minecraft: Java Edition 1.18.1 and later include the fix for vanilla clients and servers. If you run an older build, apply one of the official patches described below.

Official Fixes for Vanilla Servers

Mojang released specific guidance for older servers in December 2021. The fix depends on the release you run. Follow the steps for yours.

For Minecraft 1.17

  1. Open your server startup script (for example, start.sh or start.bat).
  2. Add the JVM argument -Dlog4j2.formatMsgNoLookups=true to the Java command.
  3. Restart the server.

For Minecraft 1.12 to 1.16.5

  1. Download Mojang's log4j2_112-116.xml file.
  2. Place it in the same directory as your server jar.
  3. Add the JVM argument -Dlog4j.configurationFile=log4j2_112-116.xml to the startup command.
  4. Restart the server.

For Minecraft 1.7 to 1.11.2

  1. Download log4j2_17-111.xml, the official configuration file for this range.
  2. Place it in the server directory.
  3. Add the JVM argument -Dlog4j.configurationFile=log4j2_17-111.xml.
  4. Restart the server.

These files disable the JNDI lookup that Log4Shell exploits. The dangerous code path never runs.

Why the Flag Alone Falls Short

You might see advice to simply add -Dlog4j2.formatMsgNoLookups=true to any release. That flag was the first mitigation, but it was later shown to be incomplete for Log4j overall, specifically for CVE-2021-45046. In some configurations the lookup could still fire through other message formats. The real fix is to upgrade to a current Minecraft build that ships the patched Log4j, or to use the release-specific XML configuration files Mojang provided for older installations.

For 1.17 the flag is the official recommendation. Upgrade to 1.18.1 or later when you can. The flag does not close every potential Log4j hole.

Checking Your Server Version

Confirm which Minecraft release your server runs before you patch. You can find this in the server console output at startup, or in the version.json file inside the server directory. If you are unsure, connect to the server and type version in the console, provided you have operator permissions.

Modded servers

If you run a modded server (Forge or Fabric, for example), the build number may not match the vanilla one exactly. Check the mod loader's release and the Minecraft release it targets. The same release-specific fixes apply. You must also inspect any plugins or mods that bundle their own copy of Log4j.

Plugins, Mods, and Paper/Spigot Servers

Paper, Spigot, and other server projects released patched builds after the disclosure. If you use one, update to the latest build that includes the fix. A patched server core is not enough. A plugin that bundles its own copy of Log4j can still leave you exposed. Update those plugins separately.

Check a plugin for its own Log4j

  1. Look inside the plugin's JAR file (for example, MyPlugin.jar) for a log4j folder or a log4j-core file.
  2. If present, check the release. If it is below the patched one, the plugin is unsafe.
  3. Visit the plugin's official page and download the latest build that includes the Log4j fix.
  4. Replace the old JAR and restart the server.

Chat messages trigger the exploit, so any plugin that logs chat or other player input is a vector. Even with a patched server core, a plugin that logs directly to Log4j might still be exploitable.

Is Minecraft Still Exposed to Log4j Today

Minecraft: Java Edition 1.18.1 and later are not susceptible to Log4Shell. Run an older build without the official patches, and your server stays wide open. The question 'is minecraft still vulnerable to log4j' has a simple answer: only if you run an unpatched release. The flaw lives in the Log4j library, not in Minecraft itself. Update both the game and any bundled Log4j copies.

Log4Shell (CVE-2021-44228) sits in CISA's Known Exploited Vulnerabilities catalog. It has been actively exploited in the wild. The initial panic has faded. Small self-hosted servers still run old builds. If you host one, verify your release and apply the correct patch today.

Practical Checklist for Server Owners

A quick checklist to lock down your Minecraft server against Log4Shell:

  • Identify your exact Minecraft build (vanilla, Paper, Spigot, or modded).
  • If you run 1.18.1 or later, you are already patched.
  • If you run 1.17, add the JVM argument -Dlog4j2.formatMsgNoLookups=true.
  • If you run 1.12 to 1.16.5, download log4j2_112-116.xml and add the configuration file argument.
  • If you run 1.7 to 1.11.2, download log4j2_17-111.xml and add the configuration file argument.
  • Update your server core (Paper, Spigot, etc.) to the latest patched build.
  • Check every plugin and mod for a bundled Log4j. Update any that are unsafe.
  • Restart the server after each change and confirm it starts normally.

These steps close the Log4Shell hole. For additional detection-only resources, visit log4shell.tools.