On 9 December 2021, a security researcher publicly disclosed a critical remote code execution vulnerability in Apache Log4j 2, a Java logging library used by hundreds of millions of systems worldwide. CVE-2021-44228, nicknamed Log4Shell, became the defining supply-chain security incident of the decade.
Log4j is a transitive dependency. Most of the systems it ran on didn't import it directly — it was imported by the logging framework used by the web framework used by the application framework used by the actual product. The actual dependency tree of a medium-sized Java application routinely has 400–800 components. That is why the question "do we use Log4j?" was so hard to answer. You cannot know your exposure to a vulnerability if you don't have a complete, machine-readable inventory of your dependencies — including transitives.
Many organisations discovered during Log4Shell that their vulnerability scanning tools were not covering transitives, were slow to update (commercial scanners relying on vendor databases took days to get signatures for Log4Shell variants — there were four CVEs in two weeks), or were not deployed in CI at all. The open-source OSV project covers transitives by design, with advisories submitted by security researchers and ecosystem owners.
After Log4j 2.15.0 was released, a partial bypass was found, then a DoS vulnerability, then a separate RCE in the 1.x branch. The lesson: knowing the version you are running is not enough — you need the exact CVE history for each component and the ability to update that knowledge quickly when new advisories are published.
Automated dependency scanning in CI catches Log4Shell-class vulnerabilities when they enter your dependency tree, not months later. SBOM generation in every build means you can query "which builds contain this PURL?" rather than re-scanning every repo when a vulnerability drops. Dependency pinning in lockfiles records exact resolved versions. Exploitability-first prioritisation lets you correctly identify the one thing that matters that week out of 400 vulnerable packages. The supply-chain attack surface did not shrink after Log4Shell — the xz-utils backdoor in 2024 showed the problem extends to deliberate supply-chain compromise. Read also: what is an SBOM? and CVSS, EPSS and KEV guide.