Skip to content
OpenAdvisories
Medium · 6.3 CVE-2026-34481 EUVD-2026-21412GHSA-w35j-pv5h-q9q9

Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout

Published Apr 10, 2026 · Updated Jul 11, 2026 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache Log4j JSON Template Layout Package: apache-log4j1.2 Package: apache-log4j2 Package: apache-log4j2 Package: apache-pulsar-4.2 Package: flink-2.1 Package: flink-2.2 Package: neo4j-2025.10 Package: neo4j-2026.01 Package: neo4j-2026.05 Package: org.apache.logging.log4j:log4j-layout-template-json Package: solr-10 Package: spark-4.0-scala-2.13 Package: spark-4.1-scala-2.13 Package: strimzi-kafka-operator-cluster-operator Package: strimzi-kafka-operator-kafka-agent Package: strimzi-kafka-operator-kafka-init Package: strimzi-kafka-operator-kafka-thirdparty-libs Package: strimzi-kafka-operator-kafka-thirdparty-libs-cc Package: strimzi-kafka-operator-topic-operator Package: strimzi-kafka-operator-tracing-agent Package: strimzi-kafka-operator-user-operator Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.

An attacker can exploit this issue only if both of the following conditions are met:

* The application uses JsonTemplateLayout.
* The application logs a MapMessage, or logs an object directly (e.g., via Logger.info(Object), which wraps it in an ObjectMessage), where the message contains an attacker-controlled floating-point value.

Users are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue.

Note: The fix released in version 2.25.4 did not cover all affected code paths. CVE-2026-49844 was assigned to the remaining issue, which concerns the MapMessage.asJson() serialization in Apache Log4j API and is fixed in versions 2.25.5 and 2.26.1.

Affected products

VendorProductAffectedFixed
Apache Software Foundation Apache Log4j JSON Template Layout 2.14.0 – < 2.25.4, 3.0.0-alpha1 – ≤ 3.0.0-beta3 2.25.4

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 apache-log4j2 No fix yet —
Debian 13 apache-log4j2 No fix yet —
Debian 12 apache-log4j2 No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 apache-log4j2 +1 No fix yet —
Ubuntu 26.04 LTS apache-log4j2 +1 No fix yet —
Ubuntu 25.10 apache-log4j2 +1 No fix yet —
Ubuntu 24.04 LTS apache-log4j2 +1 No fix yet —
Ubuntu 22.04 LTS apache-log4j2 +1 No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS apache-log4j2 +1 No fix yet —
Ubuntu 18.04 LTS apache-log4j2 +1 No fix yet —
Ubuntu Pro 16.04 LTS apache-log4j2 +1 No fix yet —
Ubuntu Pro 14.04 LTS apache-log4j1.2 No fix yet —

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed log4j 2.20.0-2.1 openSUSE-SU-2026:10544-1

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling apache-pulsar-4.2 4.2.1-r0 —
Wolfi rolling flink-2.1 2.1.1-r5 —
Wolfi rolling flink-2.2 2.2.0-r5 —
Wolfi rolling neo4j-2025.10 +1 No fix yet —
Wolfi rolling neo4j-2026.05 2026.05.0-r1 —
Wolfi rolling solr-10 10.0.0-r1 —
Wolfi rolling spark-4.0-scala-2.13 4.0.2-r11 —
Wolfi rolling spark-4.1-scala-2.13 4.1.1-r15 —
Wolfi rolling strimzi-kafka-operator-kafka-init +7 0.51.0-r22 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.apache.logging.log4j:log4j-layout-template-json >= 2.14.0, < 2.25.4 2.25.4 GHSA-w35j-pv5h-q9q9
Maven org.apache.logging.log4j:log4j-layout-template-json >= 3.0.0-alpha1, <= 3.0.0-beta3 — GHSA-w35j-pv5h-q9q9

Advisories 25

References