Properties config with partial “appenders” list fails in >= 2.25.0 with ConfigurationException: No type attribute provided for component appender

[justinas-dabravolskas]

Description

Upgrading to Log4j 2.25.0 introduces a regression in properties-based configuration when the top-level appenders property lists only a subset of the defined appenders. At startup, Log4j throws:
ConfigurationException: No type attribute provided for component appender

This appears to be caused by the new processing of “remaining” root-level properties in PropertiesConfigurationBuilder.build(), which now folds leftover dotted prefixes (like appender.) into synthetic components and then requires a type on the container key appender. In prior releases, extra appender. groups not listed in appenders did not cause a failure.
It was introduced by commit

Expected behavior

• Properties configs that specify appenders = … should not fail if additional appender..* groups exist but are not listed.

1. Only the listed (or referenced) appenders should be instantiated; unlisted groups should not trigger a root-level component parse or an exception.

Configuration

Version: >= 2.25.0

# Root logger configuration
status = warn
name = PropertiesConfig

appenders = console

# Console appender
appender.console.type = Console
appender.console.name = Console
appender.console.target = SYSTEM_OUT
appender.console.layout.type = PatternLayout
appender.console.layout.pattern = %d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n

appender.console2.type = Console
appender.console2.name = Console
appender.console2.target = SYSTEM_OUT
appender.console2.layout.type = PatternLayout
appender.console2.layout.pattern = %d{HH:mm:ss.SSS} [%t] %-5level %logger{36} - %msg%n

Logs

Caused by: org.apache.logging.log4j.core.config.ConfigurationException: No type attribute provided for component appender
	at org.apache.logging.log4j.core.config.properties.PropertiesConfigurationBuilder.createComponent(PropertiesConfigurationBuilder.java:362)
	at org.apache.logging.log4j.core.config.properties.PropertiesConfigurationBuilder.processRemainingProperties(PropertiesConfigurationBuilder.java:206)
	at org.apache.logging.log4j.core.config.properties.PropertiesConfigurationBuilder.build(PropertiesConfigurationBuilder.java:190)
Caused by: org.apache.logging.log4j.core.config.ConfigurationException: No type attribute provided for component appender

	at org.apache.logging.log4j.core.config.properties.PropertiesConfigurationFactory.getConfiguration(PropertiesConfigurationFactory.java:56)
	at org.apache.logging.log4j.core.config.properties.PropertiesConfigurationFactory.getConfiguration(PropertiesConfigurationFactory.java:34)
	at org.apache.logging.log4j.core.config.ConfigurationFactory$Factory.getConfiguration(ConfigurationFactory.java:544)
	at org.apache.logging.log4j.core.config.ConfigurationFactory$Factory.getConfiguration(ConfigurationFactory.java:463)
	at org.apache.logging.log4j.core.config.ConfigurationFactory.getConfiguration(ConfigurationFactory.java:321)
	at org.apache.logging.log4j.core.LoggerContext.reconfigure(LoggerContext.java:778)
	at org.apache.logging.log4j.core.LoggerContext.reconfigure(LoggerContext.java:808)
	at org.apache.logging.log4j.core.LoggerContext.start(LoggerContext.java:311)
	at org.apache.logging.log4j.core.impl.Log4jContextFactory.getContext(Log4jContextFactory.java:160)
	at org.apache.logging.log4j.core.impl.Log4jContextFactory.getContext(Log4jContextFactory.java:48)
	at org.apache.logging.log4j.LogManager.getContext(LogManager.java:139)
	at org.apache.logging.log4j.LogManager.getLogger(LogManager.java:557)
	at com.l4jmre.App.<clinit>(App.java:11)

Reproduction

An example configuration throws the above exception.

Workarounds

• Remove the appenders line entirely (let names be inferred), or
• List all defined appenders: appenders = console, console2

Both avoid the synthetic root-level “component appender” and the resulting exception.

[Milanka00]

Hi all,

I am experiencing the same issue while upgrading Apache Log4j from 2.24.3 to 2.25.3 in response to the reported vulnerability [1].

While debugging, it appears that this behavior was introduced by the newly added method processRemainingProperties [2].

Would it be possible to address this and release a fix? Since this was a minor version upgrade, it should ideally not introduce breaking or incompatible changes to existing log4j2.properties configurations.

Thank you for looking into this.

[1] CVE-2025-68161
[2] processRemainingProperties

[justinas-dabravolskas]

Hi @vy!
Just checking in on this. Since you handled the initial implementation of processRemainingProperties, I’d love to get your thoughts on whether this is an expected side effect or something that can/will be fixed?

Regards,

[srinireddy2020]

Recently, we upgraded Log4j2 from version 2.24.1 to 2.25.3, but it fails to support backward compatibility. Hitting ConfigurationException

[vy]

@MichaelMorrisEst, do you have some cycles to process this one?

[vy]

@justinas-dabravolskas, @Milanka00, @srinireddy2020, thanks for the report. Would you be interested in submitting a fix (incl. tests) for this one?

[MichaelMorrisEst]

@MichaelMorrisEst, do you have some cycles to process this one?

Yes, I will look into it