The reason these measures are insufficient is that, in addition to the Thread Context attack vector mentioned above, there are still code paths in Log4j where message lookups could occur: known examples are applications that use Logger.
For more information, refer to Elastic bulletin:.
Release Details From version 2.