Is there a patch available for CVE-2026-49844?

Yes, a patch is available for CVE-2026-49844. Update the affected software to the latest version immediately.

Apache Log4j API CVE-2026-49844

Q: What is the CVSS score of CVE-2026-49844?

CVE-2026-49844 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-43102 MEDIUM

Improper Encoding or Escaping of Output (CWE-116)

2026-07-10 apache

GHSA-qv9r-c865-cp47

Apache Information Disclosure Red Hat Apache Log4J Api Apache Software Foundation

6.3

CVSS 4.0 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.0 MEDIUM

AC:H reflects two mandatory non-default conditions; scope changed (S:C) because impact falls on downstream log systems, not the vulnerable application itself.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Red Hat

5.9 MEDIUM

qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 10, 2026 - 22:12 vuln.today

CVE Published

Jul 10, 2026 - 21:14 cve.org

MEDIUM 6.3

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

626 maven packages depend on org.apache.logging.log4j:log4j-api (193 direct, 433 indirect)

Ecosystem-wide dependent count for version 2.13.1.

DescriptionCVE.org

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.

The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.

The defect is reachable only when both of the following conditions hold:

The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}).
The application logs a MapMessage that contains an attacker-controlled floating-point value.

An attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.

Users are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.

AnalysisAI

Malformed JSON output in Apache Log4j API versions 2.13.1-2.25.4 and 2.26.0 allows a remote attacker who can inject non-finite floating-point values (NaN, Infinity, -Infinity) into a logged MapMessage to corrupt downstream log records and disrupt log ingestion pipelines. This is an incomplete fix follow-on to CVE-2026-34481: the prior patch left code paths in MapMessage.asJson() and MapMessage.getFormattedMessage(["JSON"]) that still emit bare IEEE 754 non-finite tokens prohibited by RFC 8259. No public exploit or active exploitation (CISA KEV) has been identified; the CVSS 4.0 score of 6.3 reflects limited subsequent-system integrity impact rather than direct host compromise.

Technical ContextAI

Apache Log4j API (CPE: cpe:2.3:a:apache_software_foundation:apache_log4j_api:*:*:*:*:*:*:*:*) provides the logging facade and message types used by the Log4j 2 ecosystem. The affected code path lies in MapMessage, a key-value message type whose asJson() method serializes entries into a JSON object. The root cause is CWE-116 (Improper Encoding or Escaping of Output): IEEE 754 defines NaN and ±Infinity as valid floating-point states, but RFC 8259 (the JSON specification) explicitly forbids these tokens as bare values. When a MapMessage entry holds such a value, the serializer emits it literally - producing structurally invalid JSON. This defect surfaces specifically through JsonTemplateLayout's message resolver and any layout that delegates to MapMessage.asJson() or the JSON-format variant of getFormattedMessage(). The CVE is a bypass of the fix applied for CVE-2026-34481, indicating the prior remediation covered only some code paths within the serialization logic.

RemediationAI

Upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant representations for non-finite floating-point values. The upstream fix is available via GitHub pull request at https://github.com/apache/logging-log4j2/pull/4163; a tagged release should be obtained from the official Apache distribution. If immediate upgrade is not feasible, the most effective compensating control is to avoid using JsonTemplateLayout's message resolver for MapMessage types, or to replace the layout with a non-JSON format until patching is complete - this eliminates the vulnerable code path without requiring a code change to the application. Alternatively, applications can sanitize floating-point values before placing them into a MapMessage (replacing NaN/±Infinity with a sentinel string such as "null" or "undefined"), though this introduces application-level logic that must be maintained. Note that neither workaround addresses other potential incomplete-fix scenarios from CVE-2026-34481; upgrade is strongly preferred.