Skip to main content

Apache Log4J Json Template Layout CVE-2026-34481

| EUVDEUVD-2026-21412 MEDIUM
Improper Encoding or Escaping of Output (CWE-116)
2026-04-10 apache GHSA-w35j-pv5h-q9q9
Apache Information Disclosure Apache Log4J Json Template Layout
6.3
CVSS 4.0 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
6.3 MEDIUM
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
SUSE
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

4
EUVD ID Assigned
Apr 10, 2026 - 16:00 euvd
EUVD-2026-21412
Analysis Generated
Apr 10, 2026 - 16:00 vuln.today
Patch released
Apr 10, 2026 - 16:00 nvd
Patch available
CVE Published
Apr 10, 2026 - 15:43 nvd
MEDIUM 6.3

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 22 maven packages depend on org.apache.logging.log4j:log4j-layout-template-json (7 direct, 15 indirect)

Ecosystem-wide dependent count for version 2.14.0.

DescriptionCVE.org

Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.

An attacker can exploit this issue only if both of the following conditions are met:

  • The application uses JsonTemplateLayout.
  • The application logs a MapMessage containing an attacker-controlled floating-point value.

Users are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue.

AnalysisAI

Apache Log4j JsonTemplateLayout versions up to 2.25.3 generate invalid JSON when logging non-finite floating-point values (NaN, Infinity, -Infinity), violating RFC 8259 and causing downstream log processing systems to fail indexing or reject records. An unauthenticated remote attacker can trigger this by controlling floating-point values in MapMessages logged by vulnerable applications, resulting in data loss or processing failures in log aggregation pipelines. Vendor-released patch: version 2.25.4.

Technical ContextAI

JsonTemplateLayout is Apache Log4j's structured JSON output formatter, used to generate RFC 8259-compliant JSON for log events. The vulnerability stems from improper handling of non-finite IEEE 754 floating-point values (NaN and infinities), which are explicitly forbidden by the JSON specification but are valid Java double/float values. When an application logs a MapMessage (a key-value log event) containing such values, JsonTemplateLayout serializes them as literal JSON strings (e.g., 'NaN', 'Infinity'), creating malformed JSON. This violates CWE-116 (Improper Encoding or Escaping of Output), where output is not properly sanitized for the consuming format. The affected component is the JSON serialization logic within the JsonTemplateLayout class (CPE: cpe:2.3:a:apache_software_foundation:apache_log4j_json_template_layout:*:*:*:*:*:*:*:*), which is part of Apache Log4j 2.x.

RemediationAI

Vendor-released patch: upgrade to Apache Log4j JSON Template Layout version 2.25.4 or later, which corrects the non-finite floating-point serialization issue. The fix is available in the upstream repository at https://github.com/apache/logging-log4j2/pull/4080. Organizations unable to upgrade immediately should review whether they are using JsonTemplateLayout (the default layouts are unaffected); if in use, implement input validation to reject or sanitize non-finite floating-point values before logging, or switch to an alternative layout format (e.g., PatternLayout or SimpleLayout). Refer to the official security advisory at https://logging.apache.org/security.html#CVE-2026-34481 and https://logging.apache.org/cyclonedx/vdr.xml for detailed remediation guidance.

Same weakness CWE-116 – Improper Encoding or Escaping of Output

View all
CVE-2013-4547 HIGH POC
7.5
CVE-2026-20245 HIGH POC
7.8
CVE-2022-36446 CRITICAL POC
9.8
CVE-2017-8303 CRITICAL POC
9.8
CVE-2022-30781 HIGH POC
7.5
CVE-2023-46301 CRITICAL POC
9.8
CVE-2023-46300 CRITICAL POC
9.8
CVE-2022-41443 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Server for SAP Applications 15 SP7 Affected

Share

CVE-2026-34481 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy