Hi! The referenced log4j version https://github.com/RUB-NDS/WS-Attacker/blob/master/pom.xml#L55 1.2.17 is very old. Log4j 1.x is end of life since 2015 and unsupported (see https://logging.apache.org/log4j/2.x/security.html). best, Ulrich