A critical RCE vulnerability (CVE-2021-44228) in Apache Log4j affects versions 2.0 through 2.16.0, with two additional CVEs discovered later. Gradle users are advised to upgrade to Log4j 2.17.0 or newer. Practical steps include using Gradle dependency constraints to block vulnerable versions in both project and build dependencies, applying organization-wide constraints via shared plugins, and using the updated Plugin Publish Plugin 0.19.0 which blocks publication of plugins with vulnerable Log4j dependencies. Gradle Build Tool itself is not affected. Gradle 7.3.3+ and 6.9.2+ automatically enforce the safe Log4j version.
