{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34481", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-03-28T19:23:37.127Z", "datePublished": "2026-04-10T15:43:00.100Z", "dateUpdated": "2026-07-11T04:55:42.502Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "cpes": ["cpe:2.3:a:apache:log4j_layout_template_json:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "org.apache.logging.log4j:log4j-layout-template-json", "packageURL": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json", "product": "Apache Log4j JSON Template Layout", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "2.25.4", "status": "affected", "version": "2.14.0", "versionType": "maven"}, {"lessThanOrEqual": "3.0.0-beta3", "status": "affected", "version": "3.0.0-alpha1", "versionType": "maven"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Ap4sh (Samy Medjahed) and Ethicxz (Eliott Laurie)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Apache Log4j's <code><a target=\"_blank\" rel=\"nofollow\" href=\"https://logging.apache.org/log4j/2.x/manual/json-template-layout.html\">JsonTemplateLayout</a></code>, in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (<code>NaN</code>, <code>Infinity</code>, or <code>-Infinity</code>), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.</p><p>An attacker can exploit this issue only if both of the following conditions are met:</p><ul><li>The application uses <code>JsonTemplateLayout</code>.</li><li>The application logs a <code>MapMessage</code>, or logs an object directly (e.g., via <code>Logger.info(Object)</code>, which wraps it in an <code>ObjectMessage</code>), where the message contains an attacker-controlled floating-point value.</li></ul><p>Users are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue.</p><p><strong>Note:</strong> The fix released in version 2.25.4 did not cover all affected code paths. CVE-2026-49844 was assigned to the remaining issue, which concerns the <code>MapMessage.asJson()</code> serialization in Apache Log4j API and is fixed in versions 2.25.5 and 2.26.1.</p>"}], "value": "Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.\n\nAn attacker can exploit this issue only if both of the following conditions are met:\n\n * The application uses JsonTemplateLayout.\n * The application logs a MapMessage, or logs an object directly (e.g., via Logger.info(Object), which wraps it in an ObjectMessage), where the message contains an attacker-controlled floating-point value.\n\n\nUsers are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue.\n\nNote: The fix released in version 2.25.4 did not cover all affected code paths. CVE-2026-49844 was assigned to the remaining issue, which concerns the MapMessage.asJson() serialization in Apache Log4j API and is fixed in versions 2.25.5 and 2.26.1."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-116", "description": "CWE-116 Improper Encoding or Escaping of Output", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-07-11T04:55:42.502Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/apache/logging-log4j2/pull/4080"}, {"tags": ["vendor-advisory"], "url": "https://logging.apache.org/security.html#CVE-2026-34481"}, {"tags": ["vendor-advisory"], "url": "https://logging.apache.org/cyclonedx/vdr.xml"}, {"tags": ["related"], "url": "https://logging.apache.org/log4j/2.x/manual/json-template-layout.html"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/n34zdv00gbkdbzt2rx9rf5mqz6lhopcv"}], "source": {"discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2026-02-16T18:14:00.000Z", "value": "Vulnerability reported by Ap4sh and ethicxz"}, {"lang": "en", "time": "2026-03-10T20:42:00.000Z", "value": "Candidate patch internally shared by Piotr P. Karwasz"}, {"lang": "en", "time": "2026-03-24T23:06:00.000Z", "value": "Fix shared publicly by Piotr P. Karwasz as pull request #4080"}, {"lang": "en", "time": "2026-03-25T09:54:00.000Z", "value": "Fix verified by the reporter"}, {"lang": "en", "time": "2026-03-28T11:19:00.000Z", "value": "Log4j 2.25.4 released"}], "title": "Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/10/10"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-10T16:18:20.891Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-10T17:41:23.224802Z", "id": "CVE-2026-34481", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T17:41:38.229Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/10/10"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-10T16:18:20.891Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34481", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-10T17:41:23.224802Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T17:41:31.864Z"}}], "cna": {"title": "Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Ap4sh (Samy Medjahed) and Ethicxz (Eliott Laurie)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"cpes": ["cpe:2.3:a:apache:log4j_layout_template_json:*:*:*:*:*:*:*:*"], "vendor": "Apache Software Foundation", "product": "Apache Log4j JSON Template Layout", "versions": [{"status": "affected", "version": "2.14.0", "lessThan": "2.25.4", "versionType": "maven"}, {"status": "affected", "version": "3.0.0-alpha1", "versionType": "maven", "lessThanOrEqual": "3.0.0-beta3"}], "packageURL": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json", "packageName": "org.apache.logging.log4j:log4j-layout-template-json", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-16T18:14:00.000Z", "value": "Vulnerability reported by Ap4sh and ethicxz"}, {"lang": "en", "time": "2026-03-10T20:42:00.000Z", "value": "Candidate patch internally shared by Piotr P. Karwasz"}, {"lang": "en", "time": "2026-03-24T23:06:00.000Z", "value": "Fix shared publicly by Piotr P. Karwasz as pull request #4080"}, {"lang": "en", "time": "2026-03-25T09:54:00.000Z", "value": "Fix verified by the reporter"}, {"lang": "en", "time": "2026-03-28T11:19:00.000Z", "value": "Log4j 2.25.4 released"}], "references": [{"url": "https://github.com/apache/logging-log4j2/pull/4080", "tags": ["patch"]}, {"url": "https://logging.apache.org/security.html#CVE-2026-34481", "tags": ["vendor-advisory"]}, {"url": "https://logging.apache.org/cyclonedx/vdr.xml", "tags": ["vendor-advisory"]}, {"url": "https://logging.apache.org/log4j/2.x/manual/json-template-layout.html", "tags": ["related"]}, {"url": "https://lists.apache.org/thread/n34zdv00gbkdbzt2rx9rf5mqz6lhopcv", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.\n\nAn attacker can exploit this issue only if both of the following conditions are met:\n\n * The application uses JsonTemplateLayout.\n * The application logs a MapMessage, or logs an object directly (e.g., via Logger.info(Object), which wraps it in an ObjectMessage), where the message contains an attacker-controlled floating-point value.\n\n\nUsers are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue.\n\nNote: The fix released in version 2.25.4 did not cover all affected code paths. CVE-2026-49844 was assigned to the remaining issue, which concerns the MapMessage.asJson() serialization in Apache Log4j API and is fixed in versions 2.25.5 and 2.26.1.", "supportingMedia": [{"type": "text/html", "value": "<p>Apache Log4j's <code><a target=\"_blank\" rel=\"nofollow\" href=\"https://logging.apache.org/log4j/2.x/manual/json-template-layout.html\">JsonTemplateLayout</a></code>, in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (<code>NaN</code>, <code>Infinity</code>, or <code>-Infinity</code>), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.</p><p>An attacker can exploit this issue only if both of the following conditions are met:</p><ul><li>The application uses <code>JsonTemplateLayout</code>.</li><li>The application logs a <code>MapMessage</code>, or logs an object directly (e.g., via <code>Logger.info(Object)</code>, which wraps it in an <code>ObjectMessage</code>), where the message contains an attacker-controlled floating-point value.</li></ul><p>Users are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue.</p><p><strong>Note:</strong> The fix released in version 2.25.4 did not cover all affected code paths. CVE-2026-49844 was assigned to the remaining issue, which concerns the <code>MapMessage.asJson()</code> serialization in Apache Log4j API and is fixed in versions 2.25.5 and 2.26.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116 Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-07-11T04:55:42.502Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34481", "state": "PUBLISHED", "dateUpdated": "2026-07-11T04:55:42.502Z", "dateReserved": "2026-03-28T19:23:37.127Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-04-10T15:43:00.100Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "cpes": ["cpe:2.3:a:apache:log4j_layout_template_json:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "org.apache.logging.log4j:log4j-layout-template-json", "packageURL": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json", "product": "Apache Log4j JSON Template Layout", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "2.25.4", "status": "affected", "version": "2.14.0", "versionType": "maven"}, {"lessThanOrEqual": "3.0.0-beta3", "status": "affected", "version": "3.0.0-alpha1", "versionType": "maven"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*", "matchCriteriaId": "FED62F2E-60EF-45CB-9F07-F6904145C372", "versionEndExcluding": "2.25.4", "versionStartIncluding": "2.14.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "5EE518C3-2F43-40FF-B754-C340B7003FC7", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*", "matchCriteriaId": "6D2A01C1-D56C-4198-8ADB-11739F791E2B", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*", "matchCriteriaId": "D6F8BD61-DD30-4D64-842C-850E5B117036", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "ED00C38D-27EA-489C-9A2B-3594ACA8A3C5", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "8794D719-1D90-4378-B48B-698EA40FBFB2", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "74C9FCBD-ECAD-4C29-B97A-2B9D97C0FC1F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.\n\nAn attacker can exploit this issue only if both of the following conditions are met:\n\n * The application uses JsonTemplateLayout.\n * The application logs a MapMessage containing an attacker-controlled floating-point value.\n\n\nUsers are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue."}], "id": "CVE-2026-34481", "lastModified": "2026-06-17T10:39:07.233", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@apache.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34481", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-10T17:41:23.224802Z", "version": "2.0.3"}}]}, "published": "2026-04-10T16:16:31.663", "references": [{"source": "security@apache.org", "tags": ["Issue Tracking"], "url": "https://github.com/apache/logging-log4j2/pull/4080"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/n34zdv00gbkdbzt2rx9rf5mqz6lhopcv"}, {"source": "security@apache.org", "tags": ["Product"], "url": "https://logging.apache.org/cyclonedx/vdr.xml"}, {"source": "security@apache.org", "tags": ["Technical Description"], "url": "https://logging.apache.org/log4j/2.x/manual/json-template-layout.html"}, {"source": "security@apache.org", "tags": ["Vendor Advisory"], "url": "https://logging.apache.org/security.html#CVE-2026-34481"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/04/10/10"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-116"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output", "id": "2457321", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457321"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-241", "details": ["A flaw was found in Apache Log4j's JsonTemplateLayout. This vulnerability allows a remote attacker to disrupt log processing systems. By sending log events that include specific non-numeric floating-point values, the attacker can cause the JsonTemplateLayout to generate invalid JSON output. This invalid output can then lead to downstream systems rejecting or failing to index these logs, effectively causing a denial of service for log analysis."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-34481", "package_state": [{"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Fix deferred", "package_name": "log4j-layout-template-json", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "log4j-layout-template-json", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Fix deferred", "package_name": "log4j-layout-template-json", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "log4j:2/log4j", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "log4j", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Fix deferred", "package_name": "log4j-layout-template-json", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Fix deferred", "package_name": "log4j-layout-template-json", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "log4j-layout-template-json", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:offline_knowledge_portal:1", "fix_state": "Fix deferred", "package_name": "redhat-user-workloads/rhokp-core-encrypted", "product_name": "Red Hat Offline Knowledge Portal"}, {"cpe": "cpe:/a:redhat:amq_streams:3", "fix_state": "Fix deferred", "package_name": "log4j-layout-template-json", "product_name": "streams for Apache Kafka 3"}], "public_date": "2026-04-10T15:43:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-34481\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34481\nhttps://github.com/apache/logging-log4j2/pull/4080\nhttps://lists.apache.org/thread/n34zdv00gbkdbzt2rx9rf5mqz6lhopcv\nhttps://logging.apache.org/cyclonedx/vdr.xml\nhttps://logging.apache.org/log4j/2.x/manual/json-template-layout.html\nhttps://logging.apache.org/security.html#CVE-2026-34481"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.14.0,2.25.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0-alpha1,3.0.0-beta3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Apache Log4j JSON Template Layout", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "log4j", "vendor": "apache"}], "analysis": {"en": {"generated_at": "2026-04-14T01:40:27.983759+00:00", "value": {"mitigation_remediation": ["Upgrade Log4j JSON Template Layout to version 2.25.4 or later.", "Verify that the application\u2019s logging configuration references the updated layout and that no legacy configuration remains.", "If an upgrade cannot be applied immediately, sanitize or replace any NaN, Infinity, or \u2013Infinity values in MapMessage payloads before logging, to ensure compliant JSON is produced.", "Monitor log processing pipelines for failures or rejected entries that may indicate the issue is still present.", "Consult the vendor\u2019s security page regularly for any new advisories related to Log4j."], "summary": {"action": "Immediate Patch", "impact": "Log corruption and potential denial of service from malformed logs"}, "threat_synthesis": {"affected_systems": "Apache Software Foundation\u2019s Log4j JSON Template Layout, with all releases through and including 2.25.3, are affected. The fix is available in 2.25.4.", "description_and_impact": "The flaw causes JsonTemplateLayout to produce JSON that contains NaN, Infinity, or \u2013Infinity values, which are forbidden by the JSON standard. When such logs are emitted, downstream log ingestion or indexing systems may reject the record or crash, effectively corrupting audit data. An attacker can trigger this only by sending an attacker\u2011controlled MapMessage containing one of those prohibited values, so the vulnerability does not enable code execution but can cause a loss of critical logs or a service interruption.", "risk_and_exploitability": "The CVSS score of 6.3 indicates a medium\u2011severity risk. The EPSS score is below 1% and the issue is not listed in the CISA KEV catalog, suggesting a low exploitation probability. However, if the attacker can inject MapMessages into the application, they could exhaust log processing resources or trigger failures that result in denial of service or loss of audit information. The attack vector is likely remote, originating from any application component that accepts user input and logs it via JsonTemplateLayout."}}}}, "created": "2026-04-13T12:44:41.113879+00:00", "updated": "2026-04-14T16:36:23.558861+00:00", "vendors": ["apache", "apache$PRODUCT$log4j"]}