The Minecraft Log4j vulnerability was a Java Edition security issue disclosed on December 10, 2021—not a newly discovered 2026 flaw. Mojang patched official Java clients through the launcher and released Minecraft 1.18.1 with a critical multiplayer-server security fix. Operators of older, modded, or third-party installations should verify the exact server software and components they use. The incident does not call for Java JVM fixes on Bedrock Edition.
What happened, and is Minecraft still vulnerable?
The Minecraft warning concerned Log4Shell, primarily tracked as CVE-2021-44228, a critical vulnerability in Apache Log4j 2, a Java logging library. In vulnerable conditions, attacker-controlled text processed by Log4j could trigger a lookup and potentially let an unauthenticated attacker execute code in the affected application. Microsoft described the risk as remote code execution that could give an attacker control of an affected application (Microsoft’s December 2021 explanation).
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Minecraft - Nintendo Switch | $29.83 | Buy on Amazon |
| 2 |
|
Minecraft: Switch Edition | $32.65 | Buy on Amazon |
| 3 |
|
Minecraft Legends Deluxe Edition | $49.00 | Buy on Amazon |
| 4 |
|
Minecraft | Standard Edition | XBOX Digital | $19.99 | Buy on Amazon |
| 5 |
|
Minecraft | Java & Bedrock Deluxe Collection | Windows Digital Code | $39.99 | Buy on Amazon |
For Minecraft, the relevant exposure was Java Edition clients and servers running vulnerable logging code—not simply opening a world or connecting to any server. Malicious data could matter if it reached a vulnerable logging path, such as chat, a username, a server message, command output, or a mod interface. A connection alone does not prove compromise.
Mojang’s December 10, 2021 notice said all official game-client versions had been patched, with the fix delivered by restarting the official launcher. Mojang also released Java Edition 1.18.1 with a critical security fix for multiplayer servers. Those statements do not automatically establish the status of a third-party launcher, old frozen installation, modpack, server proxy, plugin, or bundled library today. Verify those components with their providers.
#1 Best Overall
- Minecraft is a game about placing blocks and going on adventures
- Explore randomly generated worlds and build amazing things from the simplest of homes to the grandest of castles
- Play in creative mode with unlimited resources or mine deep into the world in survival mode, crafting weapons and armor to fend off the dangerous mobs
- Play on the go in handheld or tabletop modes
- Includes Super Mario Mash-Up, Natural Texture Pack, Biome Settlers Skin Pack, Battle & Beasts Skin Pack, Campfire Tales Skin Pack; Compatible with Nintendo Switch only
What should you do? Choose the path that matches your setup
Official Java client, with no server you operate
- Exit Minecraft Java Edition.
- Close the Minecraft Launcher completely.
- Reopen the official Minecraft Launcher.
- Allow it to download the patched files, then start the game.
This is the client procedure in Mojang’s notice. If you play only single-player using the official launcher, follow that procedure; server-side instructions below are for operators.
Self-hosted vanilla Java server
During the December 2021 emergency response, Mojang gave version-specific instructions. For 1.18, it advised upgrading to 1.18.1; for older versions it listed mitigations. The table is a historical account of those instructions, not a recommendation to keep running obsolete software.
Rank #2
- Explore randomly-generated worlds and build amazing things from the simplest of homes to the grandest of castles
- Play in Creative Mode with unlimited resources or mine deep into the world in survival mode, crafting weapons and armour to fend off the dangerous mobs
| Server version | Mojang’s December 2021 instruction |
|---|---|
| 1.18 | Upgrade to 1.18.1, which Mojang released with a critical multiplayer-server security fix. |
| 1.17.x | If an upgrade was not possible, add -Dlog4j2.formatMsgNoLookups=true to the JVM startup arguments. |
| 1.12–1.16.5 | Use Mojang’s log4j2_112-116.xml configuration file and add -Dlog4j.configurationFile=log4j2_112-116.xml. |
| 1.7–1.11.2 | Use Mojang’s log4j2_17-111.xml configuration file and add -Dlog4j.configurationFile=log4j2_17-111.xml. |
| Below 1.7 | Mojang said these versions were not affected by this specific issue. That does not make obsolete software secure against other vulnerabilities. |
See the exact instructions and linked files in Mojang’s warning. Prefer a supported update over an emergency JVM flag or configuration workaround. A Java runtime update by itself does not update the Log4j library; CISA specifically warned that upgrading Java alone does not fix this vulnerability (CISA advisory).
Modded client, third-party launcher, or modpack
Mojang warned that modified clients and third-party launchers might not update automatically, and advised users to assume an installation was not fixed if its provider had not confirmed the patch. Check the launcher or modpack provider’s security notices and whether the pack was rebuilt after the disclosure. Also verify the loader and any independently bundled libraries. A vanilla client patch does not establish that every modded component is patched.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
Rented or hosted server
Ask the host about the specific server stack, not just whether the machine has general security protection or automatic updates. Confirm responsibility for the server jar or software, proxy, panel, mods, plugins, container image, and any custom applications. The host may manage its base image while you control the server software and add-ons.
Bedrock Edition
Mojang’s Log4j warning concerned Java Edition. Do not apply Java server configuration files or JVM flags to Bedrock clients, consoles, mobile devices, or Bedrock Dedicated Servers based on this incident. This distinction does not make a claim about unrelated security issues in Bedrock software.
Rank #4
- Create and shape an infinite world, explore varied biomes filled with creatures and surprises, and go on thrilling adventures to perilous places and face mysterious foes.
- Play with friends across devices or in local multiplayer.
- Connect with millions of players on community servers, or subscribe to Realms Plus to play with up to 10 friends on your own private server.
- Get creator-made add-ons, thrilling worlds, and stylish cosmetics on Minecraft Marketplace; subscribe to Marketplace Pass (or Realms Plus) to access 150+ worlds, skin & textures packs, and more—refreshed monthly.
How to update a server safely
- Tell players about the maintenance window and stop the server cleanly.
- Back up the world and configuration files, and record the server version, loader, Java version, mods, plugins, and startup command.
- Apply a supported update or vendor-approved mitigation for the affected software. Test mod and plugin compatibility before upgrading a production world.
- Restart the server, review its console and logs for startup errors, and test player login, chat, commands, mods, plugins, and backup restoration.
- Check each separately maintained component, including proxies, plugins, mods, panels, Docker images, monitoring tools, and server-management scripts.
If moving to a newer Minecraft version would break a modpack, stage the change on a copy and confirm compatibility before switching the live server. If an immediate upgrade is not feasible, use the exact mitigation supported for the affected version and plan a migration. Do not treat a single JVM flag as a universal permanent fix.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why the old JVM flag is not a permanent answer
The -Dlog4j2.formatMsgNoLookups=true setting was an emergency mitigation for certain Log4j versions, not a fix for every release or every bundled copy. Microsoft limited its stated applicability to Log4j 2.10–2.14.1, described the workaround as incomplete, and recommended applying the security update instead (Microsoft’s guidance).
Best Value
- DELUXE COLLECTION — Includes the base game, three add-ons (Celebration Food, Rescue Dogs, and Plenty O’ Blocks), three exclusive Character Creator items, and 700 Minecoins.
- CREATE — Build whatever you can imagine in your own infinite world that’s unique in every playthrough.
- EXPLORE — Discover biomes, resources, and mobs, and craft your way through a world filled with surprises in the ultimate sandbox game.
- SURVIVE — Experience unforgettable adventures as you face mysterious foes, traverse exciting landscapes, and travel to perilous dimensions.
- PLAY TOGETHER — Have a blast with friends, whether you’re sitting on the same couch in split screen or miles apart in cross-platform play for console, mobile, and PC.
If the flag appears ineffective, check that it is in the JVM arguments used by the actual startup script or hosting panel, that the edited script launches the running server, and that the process was fully restarted. Check whether another Log4j copy is bundled and whether the server software version is one for which that mitigation was intended. For non-Minecraft Java applications, use the vendor-supported Log4j update and restart the application; historical version recommendations from the December 2021 response are not current release guidance.
What if you see suspicious activity?
A patched server can still receive malicious-looking strings. Their presence in logs alone does not show that code ran. Preserve relevant logs and investigate for unexpected process launches, unfamiliar files or accounts, changed startup scripts, unusual outbound connections, or abnormal resource use.
- If compromise is plausible, rotate server-panel, SSH, FTP, database, and other credentials.
- Review access records and backups, and contact the host if it manages the affected system.
- If there is evidence of code execution, rebuild from a known-clean image and seek incident-response help for a production server.
Players who do not operate the server should keep the official client updated, avoid untrusted servers until the operator confirms remediation, and avoid downloading purported fixes from random videos, chat messages, or file-sharing links.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
