CVE-2026-49844

Name of the Vulnerable Software and Affected Versions Apache Log4j API versions 2.13.1 through 2.25.4 Apache Log4j API version 2.26.0

Description Improper encoding of non-finite IEEE 754 floating-point values (NaN, Infinity, or -Infinity) during MapMessage JSON serialization produces output that is not valid JSON. This occurs when MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}) is used, as they emit bare tokens not permitted by RFC 8259. The issue is reachable if an application uses the event template resolver of JsonTemplateLayout or any other layout relying on these methods and logs a MapMessage containing an attacker-controlled floating-point value. This can result in malformed JSON, potentially corrupting log records or disrupting downstream log ingestion and parsing.

Recommendations For versions 2.13.1 through 2.25.4, upgrade to Apache Log4j API 2.25.5. For version 2.26.0, upgrade to Apache Log4j API 2.26.1.