Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.
An attacker can exploit this issue only if both of the following conditions are met:
* The application uses JsonTemplateLayout.
* The application logs a MapMessage containing an attacker-controlled floating-point value.
Users are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue.
References
| Link | Resource |
|---|---|
| https://github.com/apache/logging-log4j2/pull/4080 | Issue Tracking |
| https://lists.apache.org/thread/n34zdv00gbkdbzt2rx9rf5mqz6lhopcv | Mailing List Vendor Advisory |
| https://logging.apache.org/cyclonedx/vdr.xml | Product |
| https://logging.apache.org/log4j/2.x/manual/json-template-layout.html | Technical Description |
| https://logging.apache.org/security.html#CVE-2026-34481 | Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2026/04/10/10 | Mailing List Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
24 Apr 2026, 18:24
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Apache log4j
Apache |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| CPE | cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:* cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:* cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:* cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:* cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:* cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:* cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:* |
|
| References | () https://github.com/apache/logging-log4j2/pull/4080 - Issue Tracking | |
| References | () https://lists.apache.org/thread/n34zdv00gbkdbzt2rx9rf5mqz6lhopcv - Mailing List, Vendor Advisory | |
| References | () https://logging.apache.org/cyclonedx/vdr.xml - Product | |
| References | () https://logging.apache.org/log4j/2.x/manual/json-template-layout.html - Technical Description | |
| References | () https://logging.apache.org/security.html#CVE-2026-34481 - Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2026/04/10/10 - Mailing List, Third Party Advisory |
10 Apr 2026, 17:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
10 Apr 2026, 16:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-10 16:16
Updated : 2026-04-24 18:24
NVD link : CVE-2026-34481
Mitre link : CVE-2026-34481
CVE.ORG link : CVE-2026-34481
JSON object : View
Products Affected
apache
- log4j
CWE
CWE-116
Improper Encoding or Escaping of Output