From 18c3a666e25e9a0adc826f3e21dca7af5ce05a54 Mon Sep 17 00:00:00 2001
From: stefan9283 <stefan9283@users.noreply.github.com>
Date: Thu, 20 Aug 2026 13:26:47 +0000
Subject: [PATCH] Update Log4J version to fix CVE

---
 aws-lambda-java-log4j2/README.md                      | 10 +++++-----
 aws-lambda-java-log4j2/RELEASE.CHANGELOG.md           |  3 +++
 aws-lambda-java-log4j2/pom.xml                        |  2 +-
 lambda-integration-tests/log4j2-test-function/pom.xml |  2 +-
 4 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/aws-lambda-java-log4j2/README.md b/aws-lambda-java-log4j2/README.md
index d8e40ebe..b906ee8f 100644
--- a/aws-lambda-java-log4j2/README.md
+++ b/aws-lambda-java-log4j2/README.md
@@ -12,22 +12,22 @@ Example for Maven pom.xml
   <dependency>
     <groupId>com.amazonaws</groupId>
     <artifactId>aws-lambda-java-log4j2</artifactId>
-    <version>1.6.4</version>
+    <version>1.6.5</version>
   </dependency>
   <dependency>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j-core</artifactId>
-    <version>2.25.4</version>
+    <version>2.25.5</version>
   </dependency>
   <dependency>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j-api</artifactId>
-    <version>2.25.4</version>
+    <version>2.25.5</version>
   </dependency>
   <dependency>
     <groupId>org.apache.logging.log4j</groupId>
     <artifactId>log4j-layout-template-json</artifactId>
-    <version>2.25.4</version>
+    <version>2.25.5</version>
   </dependency>
   ....
 </dependencies>
@@ -75,7 +75,7 @@ If you are using the [John Rengelman](https://github.com/johnrengelman/shadow) G
 
 dependencies{
   ...
-    implementation group: 'com.amazonaws', name: 'aws-lambda-java-log4j2', version: '1.6.4'
+    implementation group: 'com.amazonaws', name: 'aws-lambda-java-log4j2', version: '1.6.5'
     implementation group: 'org.apache.logging.log4j', name: 'log4j-core', version: log4jVersion
     implementation group: 'org.apache.logging.log4j', name: 'log4j-api', version: log4jVersion
 }
diff --git a/aws-lambda-java-log4j2/RELEASE.CHANGELOG.md b/aws-lambda-java-log4j2/RELEASE.CHANGELOG.md
index 5f43862a..37e7a876 100644
--- a/aws-lambda-java-log4j2/RELEASE.CHANGELOG.md
+++ b/aws-lambda-java-log4j2/RELEASE.CHANGELOG.md
@@ -1,4 +1,7 @@
 ### May 19, 2026
+`1.6.5`:
+- Updated `log4j-core` and `log4j-api` dependencies to `2.25.5`
+
 `1.6.4`:
 - Fix regression in `1.6.3`
 
diff --git a/aws-lambda-java-log4j2/pom.xml b/aws-lambda-java-log4j2/pom.xml
index 842ef2d4..d136612f 100644
--- a/aws-lambda-java-log4j2/pom.xml
+++ b/aws-lambda-java-log4j2/pom.xml
@@ -37,7 +37,7 @@
     <properties>
         <maven.compiler.source>1.8</maven.compiler.source>
         <maven.compiler.target>1.8</maven.compiler.target>
-        <log4j.version>2.25.4</log4j.version>
+        <log4j.version>2.25.5</log4j.version>
         <junit-jupiter.version>5.12.2</junit-jupiter.version>
     </properties>
 
diff --git a/lambda-integration-tests/log4j2-test-function/pom.xml b/lambda-integration-tests/log4j2-test-function/pom.xml
index b036d1de..295ddebe 100644
--- a/lambda-integration-tests/log4j2-test-function/pom.xml
+++ b/lambda-integration-tests/log4j2-test-function/pom.xml
@@ -17,7 +17,7 @@
         <maven.compiler.source>21</maven.compiler.source>
         <maven.compiler.target>21</maven.compiler.target>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <log4j.version>2.25.4</log4j.version>
+        <log4j.version>2.25.5</log4j.version>
     </properties>
 
     <dependencies>