6.3

CVE-2026-49844: apache software foundation apache log4j api Improper Encoding or Escaping of Output

CVSS: 6.3v4.0MediumAnalyzed
AliasesUBUNTU-CVE-2026-49844DEBIAN-CVE-2026-49844CGA-239j-rr65-2xc2
Published 10-07-2026Last modified 17-09-2026
Open JSON

Vulnerability summary

CVE-2026-49844 is a medium (CVSS 6.3) Improper Encoding or Escaping of Output vulnerability in apache software foundation apache log4j api. EPSS estimates a 0.81% chance of exploitation in the next 30 days, higher than 56.2% of scored vulnerabilities.

Overall risk
25/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.3/10
010
Medium · v4.0 (CVE.org)
EPSS score
0.81%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-JQ28-C2HV-6QXC

Timeline

  1. 10-07-2026
    PublishedVulnerability first disclosed.
  2. 17-09-2026
    Last modifiedVulnerability information updated.

Description

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document. The defect is reachable only when both of the following conditions hold: * The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}). * The application logs a MapMessage that contains an attacker-controlled floating-point value. An attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing. Users are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.

CVSS metrics

9 scores · 7 sources · 2 versions

EPSS trend

Probability

0.81%

Chance of exploitation in the next 30 days

Percentile

56%

Versus all other CVEs

30-day change

0.00 pp

From 0.81% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.81%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard196 products
  • airbyte-platform-fips-server< 2.0.0-r5
  • airbyte-platform-server< 2.0.0-r6
  • airbyte-server< 2.0.0-r12
  • airbyte-server-fips< 2.0.0-r15
  • airflow-2All versions (No fix recorded)
Wolfi2 products
  • akhq< 0.28.0-r6
  • apache-activemq-artemis< 2.55.0-r3
Apache1 product
  • log4j≥ 2.13.1, < 2.25.5 | 2.26.0 | 3.0.0:alpha1 | 3.0.0:alpha1_rc1 | 3.0.0:alpha1_rc2 | 3.0.0:beta1 | 3.0.0:beta2
Apache software foundation1 product
  • apache log4j api≥ 2.13.1, < 2.25.5 | ≥ 2.26.0, < 2.26.1 | ≥ 3.0.0-alpha1, ≤ 3.0.0-beta2

4 vendors · 200 products · Showing 200 of 261. Use Open JSON for the complete list.

References

15 links
Show all 15 references