Is there any news for this issue? This is a quite major headache, if we need to downgrade to 5.4.10, there seems to be even log4j cve patches after this.