diff --git a/CHANGES.md b/CHANGES.md
index be28e3bda8..e323bbc2bc 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -7,8 +7,8 @@ Release Notes.
 
 #### Project
 
-* Upgrade log4j2 to 2.15.0 for easing the CVE concern. Officially, unless users open `level=DEBUG` for gRPC/HTTP
-  handler(s), no security error.
+* Upgrade log4j2 to 2.15.0 for CVE-2021-44228. This CVE only effects on JDK if JDNI is opened in default. Notice, using
+  JVM option `-Dlog4j2.formatMsgNoLookups=true` also avoids CVE if your JRE opened JNDI in default.
 
 #### OAP Server
 
@@ -18,6 +18,7 @@ Release Notes.
 
 #### UI
 
+
 #### Documentation
 
 All issues and pull requests are [here](https://github.com/apache/skywalking/milestone/112?closed=1)
diff --git a/apm-webapp/pom.xml b/apm-webapp/pom.xml
index 24abac6ee0..d0055ae469 100644
--- a/apm-webapp/pom.xml
+++ b/apm-webapp/pom.xml
@@ -32,7 +32,6 @@
         <java.version>1.8</java.version>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <spring.boot.version>2.4.8</spring.boot.version>
-        <log4j.version>2.6.2</log4j.version>
         <gson.version>2.8.2</gson.version>
         <apache-httpclient.version>4.5.3</apache-httpclient.version>
         <spring-cloud-dependencies.version>2020.0.3</spring-cloud-dependencies.version>
diff --git a/dist-material/release-docs/LICENSE b/dist-material/release-docs/LICENSE
index d93a167251..e228690f98 100755
--- a/dist-material/release-docs/LICENSE
+++ b/dist-material/release-docs/LICENSE
@@ -249,7 +249,7 @@ The text of each license is the standard Apache 2.0 license.
     Apache: commons-lang 3.6: https://github.com/apache/commons-lang, Apache 2.0
     Apache: commons-text 1.8: https://github.com/apache/commons-text, Apache 2.0
     Apache: commons-beanutils 1.9.4: https://github.com/apache/commons-beanutils, Apache 2.0
-    Apache: log4j2 2.14.1: https://github.com/apache/logging-log4j2, Apache 2.0
+    Apache: log4j2 2.15.0: https://github.com/apache/logging-log4j2, Apache 2.0
     Apache: zookeeper 3.5.7: https://github.com/apache/zookeeper, Apache 2.0
     Apache: commons-collections 3.2.2: https://github.com/apache/commons-collections, Apache 2.0
     Apache: commons-configuration 1.8: https://github.com/apache/commons-configuration, Apache 2.0