CVE-2026-34481

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-34481
Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records. An attacker can exploit this issue only if both of the following conditions are met: * The application uses JsonTemplateLayout. * The application logs a MapMessage, or logs an object directly (e.g., via Logger.info(Object), which wraps it in an ObjectMessage), where the message contains an attacker-controlled floating-point value. Users are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue. Note: The fix released in version 2.25.4 did not cover all affected code paths. CVE-2026-49844 was assigned to the remaining issue, which concerns the MapMessage.asJson() serialization in Apache Log4j API and is fixed in versions 2.25.5 and 2.26.1.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/apache/logging-log4j2/pull/4080 Issue Tracking
https://lists.apache.org/thread/n34zdv00gbkdbzt2rx9rf5mqz6lhopcv Mailing List Vendor Advisory
https://logging.apache.org/cyclonedx/vdr.xml Product
https://logging.apache.org/log4j/2.x/manual/json-template-layout.html Technical Description
https://logging.apache.org/security.html#CVE-2026-34481 Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/10/10 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*
cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*
cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*
cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*
History

11 Jul 2026, 06:16

Type Values Removed Values Added
Summary (en) Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records. An attacker can exploit this issue only if both of the following conditions are met: * The application uses JsonTemplateLayout. * The application logs a MapMessage containing an attacker-controlled floating-point value. Users are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue. (en) Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records. An attacker can exploit this issue only if both of the following conditions are met: * The application uses JsonTemplateLayout. * The application logs a MapMessage, or logs an object directly (e.g., via Logger.info(Object), which wraps it in an ObjectMessage), where the message contains an attacker-controlled floating-point value. Users are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue. Note: The fix released in version 2.25.4 did not cover all affected code paths. CVE-2026-49844 was assigned to the remaining issue, which concerns the MapMessage.asJson() serialization in Apache Log4j API and is fixed in versions 2.25.5 and 2.26.1.

24 Apr 2026, 18:24

Type Values Removed Values Added
References () https://github.com/apache/logging-log4j2/pull/4080 - () https://github.com/apache/logging-log4j2/pull/4080 - Issue Tracking
References () https://lists.apache.org/thread/n34zdv00gbkdbzt2rx9rf5mqz6lhopcv - () https://lists.apache.org/thread/n34zdv00gbkdbzt2rx9rf5mqz6lhopcv - Mailing List, Vendor Advisory
References () https://logging.apache.org/cyclonedx/vdr.xml - () https://logging.apache.org/cyclonedx/vdr.xml - Product
References () https://logging.apache.org/log4j/2.x/manual/json-template-layout.html - () https://logging.apache.org/log4j/2.x/manual/json-template-layout.html - Technical Description
References () https://logging.apache.org/security.html#CVE-2026-34481 - () https://logging.apache.org/security.html#CVE-2026-34481 - Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2026/04/10/10 - () http://www.openwall.com/lists/oss-security/2026/04/10/10 - Mailing List, Third Party Advisory
First Time Apache log4j
Apache
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CPE cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*
cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*
cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*
cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*
cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*

10 Apr 2026, 17:17

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/04/10/10 -

10 Apr 2026, 16:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-10 16:16

Updated : 2026-07-11 06:16

NVD link : CVE-2026-34481

Mitre link : CVE-2026-34481

CVE.ORG link : CVE-2026-34481

JSON object : View

Products Affected

apache

  • log4j
CWE
CWE-116

Improper Encoding or Escaping of Output