The vulnerability arises because the fix for a previous issue (CVE-2026-34481) did not cover all code paths in Apache Log4j API's MapMessage JSON serialization. When a MapMessage contains non-finite IEEE 754 floating-point values, the asJson() method emits bare tokens (NaN, Infinity, -Infinity) which are invalid according to RFC 8259 JSON standards. This defect manifests only if the application uses the JsonTemplateLayout's message resolver or any layout relying on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}), and logs a MapMessage containing attacker-controlled non-finite values. The malformed JSON output can corrupt log records or disrupt log ingestion and parsing downstream. The issue affects Apache Log4j API versions 2.13.1 through 2.25.4, 2.26.0, and 3.0.0-alpha1. Upgrading to versions 2.25.5 or 2.26.1 resolves the issue by emitting compliant JSON.

An attacker able to supply non-finite floating-point values in MapMessage logs can cause the affected JSON layouts to emit malformed JSON. This may corrupt the log record or disrupt downstream log ingestion and parsing systems that expect valid JSON. There is no indication of direct code execution or privilege escalation. The impact is primarily on log integrity and reliability of log processing pipelines.

Users should upgrade Apache Log4j API to version 2.25.5 or 2.26.1, which fix the improper encoding of non-finite floating-point values in JSON serialization. No other mitigations are indicated. Patch status is not explicitly stated as 'official-fix' in the vendor advisory content, but the description clearly advises upgrading to these fixed versions. Therefore, a fix is available via upgrading to these versions.