CVE-2026-49844: CWE-116 Improper Encoding or Escaping of Output in Apache Software Foundation Apache Log4j API
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document. The defect is reachable only when both of the following conditions hold: * The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}). * The application logs a MapMessage that contains an attacker-controlled floating-point value. An attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing. Users are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.
AI Analysis
Technical Summary
This vulnerability arises from improper encoding or escaping of non-finite IEEE 754 floating-point values (NaN, Infinity, -Infinity) during JSON serialization of MapMessage objects in Apache Log4j API. The affected versions (2.13.1 through 2.25.4 and 2.26.0) emit bare tokens for these values, which are invalid according to RFC 8259 JSON standards. The defect manifests only when an application uses the JsonTemplateLayout message resolver or similar layouts that rely on MapMessage.asJson() or MapMessage.getFormattedMessage with JSON formatting, and when attacker-controlled non-finite floating-point values are logged. This results in malformed JSON output that can corrupt log records or interfere with downstream log processing. The issue was partially addressed in CVE-2026-34481 but not fully resolved until versions 2.25.5 and 2.26.1, which emit RFC-compliant JSON for these values.
Potential Impact
The vulnerability causes malformed JSON output in logs when non-finite floating-point values are logged via MapMessage in affected Log4j API versions. This can corrupt log records or disrupt downstream log ingestion and parsing systems that expect valid JSON. There is no direct code execution or privilege escalation impact reported. The impact is limited to log integrity and processing reliability.
Mitigation Recommendations
Users should upgrade Apache Log4j API to version 2.25.5 or 2.26.1, which fix the improper encoding of non-finite floating-point values and produce RFC 8259-compliant JSON output. No other mitigation or workaround is indicated. Patch status is not explicitly stated in the vendor advisory, but the recommended versions provide the fix.
CVE-2026-49844: CWE-116 Improper Encoding or Escaping of Output in Apache Software Foundation Apache Log4j API
Description
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document. The defect is reachable only when both of the following conditions hold: * The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}). * The application logs a MapMessage that contains an attacker-controlled floating-point value. An attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing. Users are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.
CVSS v4.0
Score 6.3medium
Affected software
pkg:maven/Apache Software Foundation/org.apache.logging.log4j:log4j-apicpe:2.3:a:apache:log4j_api:*:*:*:*:*:*:*:*Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability arises from improper encoding or escaping of non-finite IEEE 754 floating-point values (NaN, Infinity, -Infinity) during JSON serialization of MapMessage objects in Apache Log4j API. The affected versions (2.13.1 through 2.25.4 and 2.26.0) emit bare tokens for these values, which are invalid according to RFC 8259 JSON standards. The defect manifests only when an application uses the JsonTemplateLayout message resolver or similar layouts that rely on MapMessage.asJson() or MapMessage.getFormattedMessage with JSON formatting, and when attacker-controlled non-finite floating-point values are logged. This results in malformed JSON output that can corrupt log records or interfere with downstream log processing. The issue was partially addressed in CVE-2026-34481 but not fully resolved until versions 2.25.5 and 2.26.1, which emit RFC-compliant JSON for these values.
Potential Impact
The vulnerability causes malformed JSON output in logs when non-finite floating-point values are logged via MapMessage in affected Log4j API versions. This can corrupt log records or disrupt downstream log ingestion and parsing systems that expect valid JSON. There is no direct code execution or privilege escalation impact reported. The impact is limited to log integrity and processing reliability.
Mitigation Recommendations
Users should upgrade Apache Log4j API to version 2.25.5 or 2.26.1, which fix the improper encoding of non-finite floating-point values and produce RFC 8259-compliant JSON output. No other mitigation or workaround is indicated. Patch status is not explicitly stated in the vendor advisory, but the recommended versions provide the fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- apache
- Date Reserved
- 2026-06-01T20:15:42.977Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a51650f68715ace433b3d10
Added to database: 07/10/2026, 21:33:03 UTC
Last enriched: 07/18/2026, 15:11:37 UTC
Last updated: 08/24/2026, 16:48:14 UTC
Views: 903
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.