CVE-2026-49844 Apache Software Foundation CVE debrief

Who should care

Users of Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0 should upgrade to Apache Log4j API 2.25.5 or 2.26.1. Affected operators include developers and administrators responsible for logging and log management. The vulnerability management team should review the official advisory and assess the exposure of their Log4j API deployments. Security teams should monitor logs for potential attacker-controlled floating-point values.

Technical summary

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. The defect is reachable only when both of the following conditions hold: The application uses the message resolver of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage. The application logs a MapMessage that contains an attacker-controlled floating-point value. The issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.

Defensive priority

Upgrade to Apache Log4j API 2.25.5 or 2.26.1 and review application use of JsonTemplateLayout and other layouts that rely on MapMessage.asJson() or MapMessage.getFormattedMessage

Recommended defensive actions

• Upgrade to Apache Log4j API 2.25.5 or 2.26.1
• Review application use of JsonTemplateLayout and other layouts that rely on MapMessage.asJson() or MapMessage.getFormattedMessage
• Monitor logs for potential attacker-controlled floating-point values
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. This issue is related to the encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API, which produces output that is not valid JSON. Users should verify the affected scope and validate the input to prevent potential attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.