> Ideally, log4j should not have the ability to make "outgoing calls" right? If it's in the application execution context, it will have the same abilities. If

> Ideally, log4j should not have the ability to make "outgoing calls" right? If it's in the application execution context, it will have the same abilities. If your middleware needs to make calls to third-parties, and it uses log4j, the log4j code has the same rights as the middleware app. If you're using a registry like Nexus, and it uses log4j, then it also has the ability to make calls to Maven repos, pypi repos, and anything else that Nexus can reach. And so on and so forth. Essentially you're expecting there to be privilege separation, where there is none.