The vulnerability in Apache Log4j's JsonTemplateLayout up to version 2.25.3 causes invalid JSON output when log events include non-finite floating-point values such as NaN, Infinity, or -Infinity. These values are disallowed by RFC 8259, potentially causing downstream log processing failures. Exploitation requires that the application uses JsonTemplateLayout and logs attacker-controlled floating-point values either in MapMessage or directly via ObjectMessage. The issue is fixed in version 2.25.4, but some affected code paths remain vulnerable and are addressed in subsequent versions 2.25.5 and 2.26.1 under CVE-2026-49844.

Invalid JSON output from logging non-finite floating-point values may cause downstream log processing systems to reject or fail to index affected log records. This can impact log integrity and availability for monitoring or forensic analysis. No direct code execution or privilege escalation is indicated. Exploitation requires specific logging configurations and attacker-controlled floating-point input.

Users are advised to upgrade Apache Log4j JSON Template Layout to version 2.25.4 or later to correct this issue. Note that version 2.25.4 does not cover all affected code paths; therefore, upgrading to versions 2.25.5 or 2.26.1 is recommended to fully mitigate the vulnerability. No other mitigation actions are indicated.