Log4j vulnerability (CVE-2025-68161)

Question

Hi everyone,I’ve tested the latest version of SoapUI (v5.9.1) and noticed that it is still using Log4j v2.17.1Could you please confirm whether there are plans to upgrade the Log4j component to a newer version, and if so, whether an estimated timeline is available?Thank you!

jo-laing · Answer

Hey oneagh​ Just wanted to let you know we've released SoapUI 5.10.0 which addresses the Log4j issue.&nbsp;
I hope this helps you!
&nbsp;

htmllenmsy · Answer

We ran into this exact same issue auditing SoapUI v5.9.1 last month for our company’s security check. Log4j 2.17.1 indeed hasn’t fixed this new CVE-2025-68161 flaw. As a temporary workaround before official patch rolls out, we manually swapped the log4j jar file inside SoapUI’s lib folder to latest patched 2.23.1 build. Have you tried jar replacement for your testing environment yet?

yousaf · Answer

Hi Oneagh,&nbsp;I raised this with the team and we will be addressing the in the next SoapUI release 5.10.0Appreciate you raising this, we can't provide a timeline, but rest assured it will be includedCheers,Yousaf

securebear532 · Answer

Hi Yousaf!What mitigation would you recommend for version 5.9.1 regarding this issue?&nbsp;

securebear532 · Answer

Hi!I need an update regarding both a timeline for the update and mitigation actions for version 5.9.1. Please get back to me with this information.

Forum Discussion

Log4j vulnerability (CVE-2025-68161)

9 Replies

Recent Discussions

Issue with importing collection option is getting disabled

SoapUI 5.10 Log4j vulnerability CVE-2026-49844

Bug report about parameter references

Related Content

Log4J vulnerability

Does SoapUI 5.6.0 has log4j vulnerability?

log4j security vulnerability