Was Log4Shell a risk for Minecraft Java players

Log4Shell was a critical flaw in Log4j, a Java logging library, and it affected Minecraft Java Edition 1.7 to 1.17, according to Mojang's support page. Mojang's post from December 2021 (the page is dated 12/10/21) says all versions of the client were patched and the launcher downloads the fix automatically. Servers needed manual steps depending on the version. The latest versions do not contain the exploit, per Mojang's support page (text last edited 2026-02-23). No platform can promise that every setup is clean, so the open question is what you run today.

We did not scan or test any file, server or launcher. This page reports what Mojang and other published sources say about the Log4Shell record, as read on 2026-10-24.

What Log4Shell was and why it hit Minecraft Java

Log4Shell (CVE-2021-44228) was privately reported to the Apache Software Foundation on 24 November 2021 by Chen Zhaojun of Alibaba Cloud's security team, according to Wikipedia. Apache gave it a CVSS severity of 10, the highest available. Wikipedia explains that Log4j 2 substituted expressions such as `${jndi:...}` inside logged text, so an attacker who got a crafted string logged could load and run code from a remote address.

The GitHub Blog (20 October 2025) says an attacker could put the malicious string in any field that gets logged, naming a Minecraft chat message as one example. Mojang's post warned that the exploit posed a potential risk of the computer being compromised. Wikipedia lists Minecraft: Java Edition among the affected commercial services.

Which versions were affected

Mojang's support page names Java Edition 1.7 to 1.17 as affected. Its December 2021 post treats 1.18 separately (upgrade to 1.18.1, or use the 1.17 approach) and says versions below 1.7 are not affected. The Minecraft Wiki traces the start to snapshot 13w39a, released 26 September 2013, which switched logging to Log4j 2 and which the wiki calls the first version affected.

What Mojang said and patched

For the standard launcher, Mojang's post says to close every running instance and the launcher, then start the launcher again so the patched version downloads. The Minecraft Wiki says running through the current launcher applies the patch automatically, even to old versions such as 13w39a.

For self-hosted servers, Mojang gave one step per version range. For 1.17, add the JVM argument `-Dlog4j2.formatMsgNoLookups=true`. For 1.12 to 1.16.5 and for 1.7 to 1.11.2, download a supplied XML file into the server's working directory and point `-Dlog4j.configurationFile` at it. For 1.18, upgrade to 1.18.1. Mojang's support page still lists these steps for anyone who hosts a legacy server and decides not to update.

What the fix does not cover on older versions and modpacks

Mojang's post says modified clients and third-party launchers might not be updated automatically. It advises following the third-party provider's guidance. If the provider has not patched the flaw or has not stated it is safe to play, Mojang says to assume the vulnerability is not fixed. That wording covers any setup that does not use the standard launcher.

The sources we read say nothing specific about individual modpacks or mods, so we cannot say which ones were or were not patched. A modpack pins a Minecraft version and a loader, and it may be launched through a launcher other than Mojang's. That puts it in the third-party category Mojang describes. For how mod files differ in trust, see are Minecraft mods safe, and for launcher differences see Modrinth App vs CurseForge app vs Prism Launcher.

What you can do if you run older versions or modpacks

• Use the latest version where you can. Mojang's support page says the latest versions do not contain the exploit. See how to update Minecraft on Java and Bedrock.
• On the standard launcher, close all running instances of the game and the launcher, then start the launcher again so the patched version downloads, as Mojang's post describes.
• On a modified client or third-party launcher, follow the provider's advice. Mojang's post says that if the provider has not patched the flaw or has not stated it is safe to play, you should assume it is not fixed.
• If you host a legacy server and do not update, apply the step Mojang lists for your version range, and keep in mind that the 1.17 flag alone does not cover CVE-2021-45046 according to Wikipedia.

Mojang's support page, last edited on 2026-02-23, still recommends updating to the latest version. For which Java release each Minecraft version needs, see what Java version each Minecraft release needs, and for packs, see how to install a Minecraft modpack.