CVE-2026-34481: CWE-116 Improper Encoding or Escaping of Output in Apache Software Foundation Apache Log4j JSON Template Layout
Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records. An attacker can exploit this issue only if both of the following conditions are met: * The application uses JsonTemplateLayout. * The application logs a MapMessage, or logs an object directly (e.g., via Logger.info(Object), which wraps it in an ObjectMessage), where the message contains an attacker-controlled floating-point value. Users are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue. Note: The fix released in version 2.25.4 did not cover all affected code paths. CVE-2026-49844 was assigned to the remaining issue, which concerns the MapMessage.asJson() serialization in Apache Log4j API and is fixed in versions 2.25.5 and 2.26.1.
AI Analysis
Technical Summary
CVE-2026-34481 is a vulnerability in Apache Log4j's JsonTemplateLayout component that causes it to produce invalid JSON output when log events include non-finite floating-point values (NaN, Infinity, -Infinity). These values are disallowed by the JSON specification (RFC 8259), leading to potential rejection or failure to index logs by downstream systems. Exploitation requires the application to use JsonTemplateLayout and log MapMessage or objects with attacker-controlled floating-point values. The issue affects versions up to and including 2.25.3. The vendor released version 2.25.4 to correct this, but a related serialization issue was addressed later in versions 2.25.5 and 2.26.1 under CVE-2026-49844.
Potential Impact
The vulnerability causes invalid JSON log output that may disrupt downstream log processing, including rejection or failure to index affected log records. This can impair monitoring, alerting, and forensic analysis relying on log data. There is no indication of direct code execution or data breach from this issue alone.
Mitigation Recommendations
Users should upgrade Apache Log4j JSON Template Layout to version 2.25.4 or later to address this vulnerability. Additionally, related serialization issues are fixed in versions 2.25.5 and 2.26.1. No other mitigation steps are specified. Patch status is not explicitly confirmed in the advisory, but the vendor recommends upgrading to these fixed versions.
CVE-2026-34481: CWE-116 Improper Encoding or Escaping of Output in Apache Software Foundation Apache Log4j JSON Template Layout
Description
Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records. An attacker can exploit this issue only if both of the following conditions are met: * The application uses JsonTemplateLayout. * The application logs a MapMessage, or logs an object directly (e.g., via Logger.info(Object), which wraps it in an ObjectMessage), where the message contains an attacker-controlled floating-point value. Users are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue. Note: The fix released in version 2.25.4 did not cover all affected code paths. CVE-2026-49844 was assigned to the remaining issue, which concerns the MapMessage.asJson() serialization in Apache Log4j API and is fixed in versions 2.25.5 and 2.26.1.
CVSS v4.0
Score 6.3medium
Affected software
pkg:maven/org.apache.logging.log4j/log4j-layout-template-jsonRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-34481 is a vulnerability in Apache Log4j's JsonTemplateLayout component that causes it to produce invalid JSON output when log events include non-finite floating-point values (NaN, Infinity, -Infinity). These values are disallowed by the JSON specification (RFC 8259), leading to potential rejection or failure to index logs by downstream systems. Exploitation requires the application to use JsonTemplateLayout and log MapMessage or objects with attacker-controlled floating-point values. The issue affects versions up to and including 2.25.3. The vendor released version 2.25.4 to correct this, but a related serialization issue was addressed later in versions 2.25.5 and 2.26.1 under CVE-2026-49844.
Potential Impact
The vulnerability causes invalid JSON log output that may disrupt downstream log processing, including rejection or failure to index affected log records. This can impair monitoring, alerting, and forensic analysis relying on log data. There is no indication of direct code execution or data breach from this issue alone.
Mitigation Recommendations
Users should upgrade Apache Log4j JSON Template Layout to version 2.25.4 or later to address this vulnerability. Additionally, related serialization issues are fixed in versions 2.25.5 and 2.26.1. No other mitigation steps are specified. Patch status is not explicitly confirmed in the advisory, but the vendor recommends upgrading to these fixed versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-03-28T19:23:37.127Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d91fde1cc7ad14dacba290
Added to database: 04/10/2026, 16:05:50 UTC
Last enriched: 07/11/2026, 07:54:32 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 211
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.