CVE Explorer
CVE-2026-49844
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.
The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"collectionURL":"https://repo.maven.apache.org/maven2","cpes":["cpe:2.3:a:apache:log4j_api:*:*:*:*:*:*:*:*"],"defaultStatus":"unaffected","packageName":"org.apache.logging.log4j:log4j-api","packageURL":"pkg:maven/org.apache.logging.log4j/log4j-api","product":"Apache Log4j API","vendor":"Apache Software Foundation","versions":[{"lessThan":"2.25.5","status":"affected","version":"2.13.1","versionType":"maven"},{"lessThan":"2.26.1","status":"affected","version":"2.26.0","versionType":"maven"},{"lessThanOrEqual":"3.0.0-beta2","status":"affected","version":"3.0.0-alpha1","versionType":"maven"}]}
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:650ab5ab4f43cd1fa027ebc818b9d8de3bfe2e1120c937585b7eaff3a7d843f6 · sha256:b8a75f521a12656a… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":6.3,"baseSeverity":"MEDIUM","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":…
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:650ab5ab4f43cd1fa027ebc818b9d8de3bfe2e1120c937585b7eaff3a7d843f6 · sha256:b8a75f521a12656a… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-116","description":"CWE-116 Improper Encoding or Escaping of Output","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:650ab5ab4f43cd1fa027ebc818b9d8de3bfe2e1120c937585b7eaff3a7d843f6 · sha256:b8a75f521a12656a… · /containers/cna/problemTypes/0/descriptions/0
Source references
4 source assertions{"tags":["patch"],"url":"https://github.com/apache/logging-log4j2/pull/4163"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:650ab5ab4f43cd1fa027ebc818b9d8de3bfe2e1120c937585b7eaff3a7d843f6 · sha256:b8a75f521a12656a… · /containers/cna/references/1
{"tags":["vendor-advisory"],"url":"https://logging.apache.org/cyclonedx/vdr.xml"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:650ab5ab4f43cd1fa027ebc818b9d8de3bfe2e1120c937585b7eaff3a7d843f6 · sha256:b8a75f521a12656a… · /containers/cna/references/2
{"tags":["related"],"url":"https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:650ab5ab4f43cd1fa027ebc818b9d8de3bfe2e1120c937585b7eaff3a7d843f6 · sha256:b8a75f521a12656a… · /containers/cna/references/0
{"tags":["vendor-advisory"],"url":"https://logging.apache.org/security.html#CVE-2026-49844"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:650ab5ab4f43cd1fa027ebc818b9d8de3bfe2e1120c937585b7eaff3a7d843f6 · sha256:b8a75f521a12656a… · /containers/cna/references/3
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.