CVE-2026-49844

A flaw was found in Apache Log4j API. This vulnerability occurs due to improper encoding of non-finite floating-point values during JSON serialization of MapMessages, leading to invalid JSON output. An attacker who can supply a non-finite value can exploit this to cause the affected logging layout to emit malformed JSON. This can corrupt log records or disrupt downstream log ingestion and parsing, potentially leading to a Denial of Service (DoS) or information integrity issues.

Important: Apache Log4j API in Red Hat products is affected by improper encoding of non-finite floating-point values during MapMessage JSON serialization. This flaw can lead to malformed JSON output when applications utilize JsonTemplateLayout or similar JSON serialization methods and process attacker-controlled floating-point values. The resulting invalid JSON may disrupt downstream log processing or corrupt log records, requiring specific application configurations for exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.