RHLW-2026-7730fdc080197dfe: Lightwell Security Advisory: log4j-api 2.25.4.rhlw-00001
Red Hat Lightwell has released org.apache.logging.log4j:log4j-api 2.25.4.rhlw-00001 with a backported security fix.
CVE-2026-49844: Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()
This patched artifact is a drop-in replacement for org.apache.logging.log4j:log4j-api 2.25.4 from Maven Central.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/org.apache.logging.log4j:log4j-apito a version that resolves this vulnerability.Fixed in 2.25.4.rhlw-00001 - Upgrade
Upgrade
org.apache.logging.log4j:log4j-apito a version that resolves this vulnerability.Fixed in 2.25.4.rhlw-00001
Event History
Frequently Asked Questions
Which component should be replaced to obtain the fix?
Replace org.apache.logging.log4j:log4j-api 2.25.4 from Maven Central with Red Hat Lightwell's org.apache.logging.log4j:log4j-api 2.25.4.rhlw-00001. The advisory states that the patched artifact is a drop-in replacement.
What condition is associated with exploitation?
The issue concerns improper serialization of non-finite floating-point values in MapMessage.asJson(). The supplied vector indicates network reachability, no required privileges or user interaction, and high attack complexity.