This vulnerability stems from the MapMessage JSON serializer emitting tokens for non‑finite IEEE 754 values such as NaN, Infinity, or –Infinity. The RFC 8259 standard forbids these tokens, so an attacker who can insert a non‑finite value into a MapMessage causes the resulting JSON to be syntactically incorrect. A conformant parser will reject or misinterpret the malformed record, which can corrupt the surrounding log entry or prevent downstream services from ingesting the log data, leading to operational disruption or loss of critical audit information.

The flaw affects the Apache Log4j API version 2.13.1 through 2.25.4 and 2.26.0. It is exploitable only when an application uses the JsonTemplateLayout message resolver or any layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}) and logs a MapMessage containing an attacker‑controlled floating‑point value.

The CVSS score of 6.3 indicates a moderate severity, and the EPSS score of < 1% suggests a very low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires both an input path that allows injection of a non‑finite value into a MapMessage and a layout that serializes it to JSON, making the attack vector likely to be application‑level input that ends up in logs. Successful exploitation can result in malformed logs that disrupt downstream log ingestion or correlate logs, providing a denial‑of‑service path.