Description
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.

The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.

The defect is reachable only when both of the following conditions hold:

* The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}).
* The application logs a MapMessage that contains an attacker-controlled floating-point value.


An attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.

Users are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.
Published: 2026-07-10
Score: 6.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The bug occurs when MapMessage.asJson() writes non‑finite IEEE 754 values as raw tokens, violating RFC 8259 and being captured as CWE‑116. An attacker who can supply NaN, Infinity, or -Infinity into a MapMessage makes the JSON output syntactically invalid. A compliant parser will reject the record, potentially corrupting the surrounding log or halting log ingestion, which can disrupt downstream processing or audit trails.

Affected Systems

The vulnerability affects Apache Log4j API versions 2.13.1 through 2.25.4 and 2.26.0. It is limited to applications that use the JsonTemplateLayout message resolver or any layout that calls MapMessage.asJson() or MapMessage.getFormattedMessage(new String[JSON]). All other Log4j API users are not affected.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity, while the EPSS score of < 1% translates to a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that an attacker can insert a non‑finite value into a MapMessage and that the application serializes the message to JSON; therefore the attack vector is most likely application‑level input that ends up in logs. If achieved, the malformed JSON can cause downstream services to reject log entries, leading to loss of audit data or denial‑of‑service to log processing components.

Generated by OpenCVE AI on July 31, 2026 at 12:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Log4j API to 2.25.5 or 2.26.1, which emit RFC 8259‑compliant JSON for non‑finite values.
  • Validate or sanitize floating‑point values before adding them to MapMessage objects, replacing NaN, Infinity, or -Infinity with finite values or omitting them entirely.
  • Disable or replace JsonTemplateLayout or any layout that relies on MapMessage.asJson() if an immediate upgrade cannot be applied, thus removing the vulnerable serialization path.
  • Monitor log ingestion pipelines for errors indicative of malformed JSON and alert on failures.

Generated by OpenCVE AI on July 31, 2026 at 12:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-qv9r-c865-cp47 Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization
History

Fri, 10 Jul 2026 21:30:00 +0000

Type Values Removed Values Added
Description Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document. The defect is reachable only when both of the following conditions hold: * The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}). * The application logs a MapMessage that contains an attacker-controlled floating-point value. An attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing. Users are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.
Title Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()
First Time appeared Apache
Apache log4j Api
Weaknesses CWE-116
CPEs cpe:2.3:a:apache:log4j_api:*:*:*:*:*:*:*:*
Vendors & Products Apache
Apache log4j Api
References
Metrics cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N'}

Subscriptions

Apache Log4j Log4j Api
cve-icon MITRE

Status: PUBLISHED

Assigner: apache

Published:

Updated: 2026-07-14T14:35:11.005Z

Reserved: 2026-06-01T20:15:42.977Z

Link: CVE-2026-49844

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-07-10T22:16:42.540

Modified: 2026-07-14T20:03:09.910

Link: CVE-2026-49844

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T13:00:10Z

Weaknesses
  • CWE-116

    Improper Encoding or Escaping of Output