# SonarCloud and scanning for the Log4J vulnerability

**URL:** <https://community.sonarsource.com/t/sonarcloud-and-scanning-for-the-log4j-vulnerability/54748>\
**Category:** SonarQube Cloud\
**Created:** [December 11, 2021, 7:28pm UTC](https://community.sonarsource.com/t/sonarcloud-and-scanning-for-the-log4j-vulnerability/54748 "2021-12-11T19:28:07Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![spirovskib](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/spirovskib/32/28313_2.png) [@spirovskib](https://community.sonarsource.com/u/spirovskib)\
**Post date:** [December 11, 2021, 7:28pm UTC](https://community.sonarsource.com/t/sonarcloud-and-scanning-for-the-log4j-vulnerability/54748/1 "2021-12-11T19:28:07Z")

</div>

Hi all

Can you please advise whether SonarCloud scan can identify the use of Log4J in the repository?  
If we add a repo in SonarCloud, will we get an alert on the use of the Log4J library and whether it’s vulnerable?

Best  
Bozidar

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [December 13, 2021, 8:24am UTC](https://community.sonarsource.com/t/sonarcloud-and-scanning-for-the-log4j-vulnerability/54748/2 "2021-12-13T08:24:58Z")

</div>

Hey there.

SonorCloud is really focused on SAST (Static Application Security Testing) rather than SCA (Software Component Analysis). SonarCloud can’t be configured to raise issues if log4j is found.

---

<div class="post-metadata">

**Author:** ![system](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/system/32/31083_2.png) [@system](https://community.sonarsource.com/u/system)\
**Post date:** [January 27, 2022, 10:37am UTC](https://community.sonarsource.com/t/sonarcloud-and-scanning-for-the-log4j-vulnerability/54748/3 "2022-01-27T10:37:34Z")

</div>

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [March 18, 2025, 2:37pm UTC](https://community.sonarsource.com/t/sonarcloud-and-scanning-for-the-log4j-vulnerability/54748/4 "2025-03-18T14:37:36Z")

</div>

Hello from the future!

We recently announced SonarQube Advanced Security, which will include SCA capabilities. While it’s not available yet, we expect general availability for SonarQube Server in May 2025, and SonarQube Cloud Enterprise shortly after.

Please see this announcement for more details.

> [@Announcing SonarQube Advanced Security](https://community.sonarsource.com/t/announcing-sonarqube-advanced-security/136625):
>
> Sonar is excited to [announce SonarQube Advanced Security](https://www.sonarsource.com/company/press-releases/sonar-extends-code-security-coverage-with-sonarqube-advanced-security/), extending SonarQube’s analysis capabilities beyond first-party and AI-generated code to include third-party open source code. With this, we’re delivering the first fully integrated solution for finding and fixing code quality and code security issues in the development phase of the SDLC. The first step in integrating Sonar’s recent acquisition of Tidelift, SonarQube Advanced Security strengthens a robust set of existing security capabili…