Who pays? Well, there is a large list of sponsors on the apache project website (which log4j is a part of): https://www.apache.org/foundation/thanks.html https:

Who pays? Well, there is a large list of sponsors on the apache project website (which log4j is a part of): https://www.apache.org/foundation/thanks.html https://www.apache.org/foundation/thanks.html Who fixes it? Well, I don’t see anything inherently broken. That a bug like it could happen in any other commercial software too. It’s already fixed btw.