Originally posted by oneagh on January 21, 2026 Hi everyone, I’ve tested the latest version of SoapUI (v5.9.1) and noticed that it is still using Log4j v2.17.1 Could you please confirm whether there are plans to upgrade the Log4j component to a newer version, and if so, whether an estimated tim…

Originally posted by yousaf on January 30, 2026 Hi Oneagh, I raised this with the team and we will be addressing the in the next SoapUI release 5.10.0 Appreciate you raising this, we can’t provide a timeline, but rest assured it will be included Cheers, Yousaf

Originally posted by Securebear532 on February 15, 2026 Hi Yousaf! What mitigation would you recommend for version 5.9.1 regarding this issue?

Originally posted by Securebear532 on March 16, 2026 Hi! I need an update regarding both a timeline for the update and mitigation actions for version 5.9.1. Please get back to me with this information.

Originally posted by yousaf on March 26, 2026 Hi, Sorry for the late reply, If you are position to build SoapUI from source, then you can apply the changes in this pull request, which will address the issue, and will be included in the next release …

Originally posted by htmllenmsy on June 05, 2026 We ran into this exact same issue auditing SoapUI v5.9.1 last month for our company’s security check. Log4j 2.17.1 indeed hasn’t fixed this new CVE-2025-68161 flaw. As a temporary workaround before official patch rolls out, we manually swapped the …

Originally posted by oneagh on June 05, 2026 This is great. Thank you very much.

Originally posted by oneagh on June 05, 2026 Hi htmllenmsy. That’s a good suggestion. I hadn’t thought about replacing the JAR as a test workaround. I’ll try it out next time.Thanks for sharing it

Originally posted by Securebear532 on June 08, 2026 Thank you for the update :slight_smile:

Log4j vulnerability (CVE-2025-68161)

Open Source SoapUI OS

system June 4, 2026, 12:28pm 6

Originally posted by Jo-Laing on June 04, 2026

Hey oneagh
Just wanted to let you know we’ve released SoapUI 5.10.0 which addresses the Log4j issue.

I hope this helps you!

Topic		Replies	Views
SOAPUI 5.9.1 Still Includes Log4j 2.17.1 — When Will an Updated Version Be Released? SoapUI OS api , soapui , migrated , soap , latest	1	2	June 8, 2026
SoapUI 5.10.0 is now available SoapUI OS api , soapui , migrated , soap , latest , opensource	5	20	October 21, 2026
SoapUI 5.10 Log4j vulnerability CVE-2026-49844 SoapUI OS api , soapui , migrated , latest	1	4	September 25, 2026
ReadyAPI Log4j version 2.25.4 ReadyAPI readyapi , api , migrated , latest	1	1	July 13, 2026
Which Log4j Version ReadyAPI readyapi , api , migrated , latest	1	2	June 11, 2026

Log4j vulnerability (CVE-2025-68161)

Related topics