# Log4j Vulnerability in ODK Aggregate?

**URL:** <https://forum.getodk.org/t/log4j-vulnerability-in-odk-aggregate/36098>\
**Category:** Support\
**Tags:** odk-aggregate\
**Created:** [December 13, 2021, 10:51am UTC](https://forum.getodk.org/t/log4j-vulnerability-in-odk-aggregate/36098 "2021-12-13T10:51:26Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![yanokwa](https://getodk.b-cdn.net/user_avatar/forum.getodk.org/yanokwa/32/1695_2.png) [@yanokwa](https://forum.getodk.org/u/yanokwa)\
**Post date:** [December 13, 2021, 3:16pm UTC](https://forum.getodk.org/t/log4j-vulnerability-in-odk-aggregate/36098/2 "2021-12-13T15:16:19Z")

</div>

Aggregate reached end-of-life status on May 2021 and is [no longer being updated](https://forum.getodk.org/t/aggregate-is-no-longer-being-updated/33742).

I have taken a cursory look at Aggregate's dependencies and I do not believe it is susceptible to the recent log4j vulnerability ([CVE-2021-44228](https://www.cve.org/CVERecord?id=CVE-2021-44228)).

That said, **you should not be running Aggregate because it is likely susceptible to other vulnerabilities.**

I urge you to migrate to Central. Get started with the [install docs](https://docs.getodk.org/central-install).

---

_[View the full topic](https://forum.getodk.org/t/log4j-vulnerability-in-odk-aggregate/36098)._