How to Patch Minecraft for the Log4J2 Exploit

Updated on December 11, 2021
How to Patch Minecraft for the Log4J2 Exploit header image

Urgent: Upgrade your Minecraft Servers

Minecraft servers before version 1.18.1 are vulnerable to a Remote Code Execution attack. You must upgrade immediately.

  • If you deploy a new Minecraft server at Vultr, you are protected. Vultr's Minecraft server image has been upgraded to version 1.18.1, which is safeguarded against the exploit.
  • If your server is version 1.18 or earlier, you must upgrade. Please use these instructions.

How to Patch your Minecraft Server

  1. Connect to your server with SSH as root.

  2. Create in your text editor.

     # nano ~/
  3. Paste the following script:

     echo "Vultr Minecraft Log4j RCE Patcher - v1.0"
     if ! [ -z "$(grep "Dlog4j.configurationFile=log4j2.xml" /home/minecraft/" ]; then
         echo "Already patched!"
         exit 0
     echo "Grabbing version!"
     VERSION="$(cat minecraft_server_version)"
     VERSION_MAJOR="$(echo ${VERSION} | awk -F'.' '{print $1}')"
     VERSION_MINOR="$(echo ${VERSION} | awk -F'.' '{print $2}')"
     echo "Found Version: ${VERSION}"
     if [ "${VERSION_MAJOR}" == "1" ] && [ "${VERSION_MINOR}" -lt "12" ]; then
         echo "Found OLD Version: ${VERSION}, using pre 1.12 xml fix!"
     if [ "${VERSION}" == "1.18.1" ] || [ "${VERSION_MINOR}" -gt "18" ]; then
         echo "Found NEW Version: ${VERSION}, no patch needed!"
         exit 0
     echo "Downloading: ${URL}"
     curl -Ls "${URL}" > /home/minecraft/log4j2.xml
     echo "Patching: /home/minecraft/"
     sed -i -e 's/java -Xmx/java -Dlog4j.configurationFile=log4j2.xml -Xmx/g' /home/minecraft/
  4. Type Ctrl+X, and then Y to save and exit.

  5. Make the script executable.

     # chmod u+x ~/
  6. Run the script.

     # bash ~/
  7. As a precaution, please reboot your server.

More Information

There is a new zero-day exploit for the Log4J2 library used by Minecraft. This exploit allows unsophisticated attackers to take over your server remotely. The vulnerability has been reported with CVE-2021-44228 against the log4j-core jar and is fixed in Log4J v2.15.0.

To protect our network, Vultr may shut down vulnerable Minecraft servers. Please upgrade immediately.