Vulnerability in Apache Log4j
CVE-2026-34481
Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records. An attacker can exploit this issue only if both of the following conditions are met: * The application uses JsonTemplateLayout. * The application logs a MapMessage, or logs an object directly (e.g., via Logger.info(Object), which wraps it in an ObjectMessage), where the message contains an attacker-controlled floating-point value. Users are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue. Note: The fix released in version 2.25.4 did not cover all affected code paths. CVE-2026-49844 was assigned to the remaining issue, which concerns the MapMessage.asJson() serialization in Apache Log4j API and is fixed in versions 2.25.5 and 2.26.1.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.009 (57.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 58th percentile — 57.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.009 · change: +0.002
Affected products
- Apache Log4j — versions 3.0.0
- Apache Software Foundation Log4j JSON Template Layout — versions 2.14.0, 3.0.0-alpha1
Weakness classification (CWE)
References
- github.com/apache/logging-log4j2/pull/4080 (patch, Issue Tracking)
- logging.apache.org/security.html (vendor-advisory, Vendor Advisory)
- logging.apache.org/cyclonedx/vdr.xml (Product, vendor-advisory)
- logging.apache.org/log4j/2.x/manual/json-template-layout.html (Technical Description, related)
- lists.apache.org/thread/n34zdv00gbkdbzt2rx9rf5mqz6lhopcv (vendor-advisory, Mailing List, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2026-34481?
- CVE-2026-34481 is a high-severity vulnerability in Apache Log4j, classified under Improper Encoding or Escaping of Output. CVSS score: 7.5/10. Published 2026-04-10.
- How severe is CVE-2026-34481?
- High severity. CVSS v3 base score is 7.5 out of 10.