CVE-2026-49844: Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.
The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.
The defect is reachable only when both of the following conditions hold:
The application uses the message resolver
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Log4j APIto a version that resolves this vulnerability.Fixed in 2.25.5 - Upgrade
Upgrade
Apache Log4j APIto a version that resolves this vulnerability.Fixed in 2.26.1 - Compensating control
If upgrading is not immediately possible, ensure attackers cannot supply non-finite floating-point values (NaN, Infinity, -Infinity) that reach MapMessage used by JsonTemplateLayout event-template-resolver-message or other layouts that rely on MapMessage.asJson() / MapMessage.getFormattedMessage(new String[]{"JSON"}) by validating and rejecting non-finite inputs before they are placed into the MapMessage.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49844?
The severity of CVE-2026-49844 is rated medium with a CVSS score of 6.3.
What does CVE-2026-49844 affect?
CVE-2026-49844 affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.
What is the main issue with CVE-2026-49844?
The main issue with CVE-2026-49844 is improper serialization of non-finite floating-point values during JSON serialization.
How can I mitigate the risks of CVE-2026-49844?
To mitigate the risks of CVE-2026-49844, you should upgrade to a patched version of Apache Log4j API.
Is CVE-2026-49844 exploitable?
CVE-2026-49844 may lead to invalid JSON output but does not have a direct exploit impact, making it primarily a data integrity concern.