It depends on the specific case, and which portions of the log4j library are being used. While log4j-core is vulnerable, log4j-api is NOT vulnerable. For the most comprehensive results, we recommend using a software composition analysis (SCA) scanning tool such as JFrog Xray to identify the vulnerabilities in all of your software dependencies – including those related to log4j, but also many, many more. If that isn’t available to you, you can use the OSS tools JFrog created for the community to specifically to identify log4j utilization in source code and binaries