True. And some apps using log4j2 might escape any user input in a way that they can use the flawed versions and be safe. I believe there is just one theoretical

True. And some apps using log4j2 might escape any user input in a way that they can use the flawed versions and be safe. I believe there is just one theoretical exploit of 1.x known that relates to its socket server. It isn't supported anymore and 2.x is recommended, but I wouldn't call it a security flaw if you use it.