CVE-2026-49844
Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.
The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.
The defect is reachable only when both of the following conditions hold:
- The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}).
- The application logs a MapMessage that contains an attacker-controlled floating-point value.
An attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.
Users are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.
The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.
The defect is reachable only when both of the following conditions hold:
- The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}).
- The application logs a MapMessage that contains an attacker-controlled floating-point value.
An attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.
Users are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.
- Record
CVE-2026-49844- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-116
- Updated
- 2026-11-02
EUVDEUVD-2026-43102
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.
The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.
The defect is reachable only when both of the following conditions hold:
- The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}).
- The application logs a MapMessage that contains an attacker-controlled floating-point value.
An attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.
Users are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.
- Record
EUVD-2026-43102- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qv9r-c865-cp47
Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.
The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.
The defect is reachable only when both of the following conditions hold:
- The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}).
- The application logs a MapMessage that contains an attacker-controlled floating-point value.
An attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.
Users are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.
- Record
GHSA-qv9r-c865-cp47- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-116
- Updated
- 2026-11-02
NVD
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.
The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.
The defect is reachable only when both of the following conditions hold:
- The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}).
- The application logs a MapMessage that contains an attacker-controlled floating-point value.
An attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.
Users are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.
- Record
CVE-2026-49844- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-116
- Updated
- 2026-11-02
OSV
Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.
The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.
The defect is reachable only when both of the following conditions hold:
- The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}).
- The application logs a MapMessage that contains an attacker-controlled floating-point value.
An attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.
Users are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.
- Record
CVE-2026-49844- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-116
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-49844
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document. The defect is reachable only when both of the following conditions hold: * The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}). * The application logs a MapMessage that contains an attacker-controlled floating-point value. An attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing. Users are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.
- Record
DEBIAN-CVE-2026-49844- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 10 moreShow less
OSVGHSA-qv9r-c865-cp47
Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.
The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.
The defect is reachable only when both of the following conditions hold:
- The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}).
- The application logs a MapMessage that contains an attacker-controlled floating-point value.
An attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.
Users are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.
- Record
GHSA-qv9r-c865-cp47- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-116
- Updated
- 2026-11-02
OSVOESA-2026-3153
log4j security update
Log4j is a tool to help the programmer output log statements to a variety of output targets.
Security Fix(es):
Apache Log4j's JsonTemplateLayout in versions up to and including 2.25.3 produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records. An attacker can exploit this issue only if both of the following conditions are met: 1) The application uses JsonTemplateLayout; 2) The application logs a MapMessage containing an attacker-controlled floating-point value.(CVE-2026-34481)
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.
The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.
The defect is reachable only when both of the following conditions hold:
- The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}).
- The application logs a MapMessage that contains an attacker-controlled floating-point value.
An attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.
Users are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.(CVE-2026-49844)
- Record
OESA-2026-3153- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-49844
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document. The defect is reachable only when both of the following conditions hold: * The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}). * The application logs a MapMessage that contains an attacker-controlled floating-point value. An attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing. Users are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.
- Record
UBUNTU-CVE-2026-49844- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1784624635 No score
log4j: Fix of CVE-2026-49844
- CVE-2026-49844: fix MapMessage JSON serialization of non-finite floating-point values (NaN, Infinity)
- Record
CLSA-2026-1784624635- Updated
- 2026-11-02
OSVCLSA-2026-1785380784 No score
TuxCare security update for org.apache.logging.log4j:log4j-api (1 CVE)
TuxCare rebuilt org.apache.logging.log4j:log4j-api to address 1 CVE. Fixed in 2.22.1-tuxcare.3.
- Record
CLSA-2026-1785380784- Updated
- 2026-11-02
OSVCLSA-2026-1787471222 No score
TuxCare security update for org.apache.logging.log4j (3 CVEs)
TuxCare rebuilt 4 org.apache.logging.log4j packages to address 3 CVEs. Fixed in 2.23.1-tuxcare.1.
- Record
CLSA-2026-1787471222- Updated
- 2026-11-02
OSVCLSA-2026-1787726168 No score
TuxCare security update for org.apache.logging.log4j (4 CVEs)
TuxCare rebuilt 3 org.apache.logging.log4j packages to address 4 CVEs. Fixed in 2.24.3-tuxcare.2.
- Record
CLSA-2026-1787726168- Updated
- 2026-11-02
OSVCLSA-2026-1792696729 No score
TuxCare security update for org.apache.logging.log4j (5 CVEs)
TuxCare rebuilt 4 org.apache.logging.log4j packages to address 5 CVEs. Fixed in 2.20.0-tuxcare.2.
- Record
CLSA-2026-1792696729- Updated
- 2026-11-02
OSVCLSA-2026-1793052872 No score
TuxCare security update for org.apache.logging.log4j (4 CVEs)
TuxCare rebuilt 4 org.apache.logging.log4j packages to address 4 CVEs. Fixed in 2.21.1-tuxcare.1.
- Record
CLSA-2026-1793052872- Updated
- 2026-11-02
OSVCLSA-2026-1793727635 No score
TuxCare security update for org.apache.logging.log4j (2 CVEs)
TuxCare rebuilt 2 org.apache.logging.log4j packages to address 2 CVEs. Fixed in 2.24.1-tuxcare.4.
- Record
CLSA-2026-1793727635- Updated
- 2026-11-04
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.logging.log4j:log4j-apiMaven |
2.13.1 up to 2.25.5 | 2.25.5 |
org.apache.logging.log4j:log4j-apiMaven |
2.26.0 up to 2.26.1 | 2.26.1 |
log4jTuxCare:AlmaLinux:9.6 |
before 2.17.2-1.el9.tuxcare.els2 | 2.17.2-1.el9.tuxcare.els2 |
log4j-jclTuxCare:AlmaLinux:9.6 |
before 2.17.2-1.el9.tuxcare.els2 | 2.17.2-1.el9.tuxcare.els2 |
log4j-slf4jTuxCare:AlmaLinux:9.6 |
before 2.17.2-1.el9.tuxcare.els2 | 2.17.2-1.el9.tuxcare.els2 |
log4j-webTuxCare:AlmaLinux:9.6 |
before 2.17.2-1.el9.tuxcare.els2 | 2.17.2-1.el9.tuxcare.els2 |
org.apache.logging.log4j:log4j-apiTuxCare:Maven |
2.22.1 up to 2.22.1-tuxcare.3, plus listed versions 2.22.1-tuxcare.12.22.1-tuxcare.2 |
2.22.1-tuxcare.3 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 3 CVEs |
2.23.1 up to 2.23.1-tuxcare.1 | 2.23.1-tuxcare.1 |
org.apache.logging.log4j:log4j-apiTuxCare:Maven From an advisory covering 3 CVEs |
2.23.1 up to 2.23.1-tuxcare.1 | 2.23.1-tuxcare.1 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 3 CVEs |
2.23.1 up to 2.23.1-tuxcare.1 | 2.23.1-tuxcare.1 |
Show 30 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.apache.logging.log4j:log4j-layout-template-jsonTuxCare:Maven From an advisory covering 3 CVEs |
2.23.1 up to 2.23.1-tuxcare.1 | 2.23.1-tuxcare.1 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 4 CVEs |
2.24.3 up to 2.24.3-tuxcare.2, plus listed versions 2.24.3-tuxcare.1 |
2.24.3-tuxcare.2 |
org.apache.logging.log4j:log4j-apiTuxCare:Maven From an advisory covering 4 CVEs |
2.24.3 up to 2.24.3-tuxcare.2, plus listed versions 2.24.3-tuxcare.1 |
2.24.3-tuxcare.2 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 4 CVEs |
2.24.3 up to 2.24.3-tuxcare.2, plus listed versions 2.24.3-tuxcare.1 |
2.24.3-tuxcare.2 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 5 CVEs |
2.20.0 up to 2.20.0-tuxcare.2, plus listed versions 2.20.0-tuxcare.1 |
2.20.0-tuxcare.2 |
org.apache.logging.log4j:log4j-apiTuxCare:Maven From an advisory covering 5 CVEs |
2.20.0 up to 2.20.0-tuxcare.2, plus listed versions 2.20.0-tuxcare.1 |
2.20.0-tuxcare.2 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 5 CVEs |
2.20.0 up to 2.20.0-tuxcare.2, plus listed versions 2.20.0-tuxcare.1 |
2.20.0-tuxcare.2 |
org.apache.logging.log4j:log4j-layout-template-jsonTuxCare:Maven From an advisory covering 5 CVEs |
2.20.0 up to 2.20.0-tuxcare.2, plus listed versions 2.20.0-tuxcare.1 |
2.20.0-tuxcare.2 |
org.apache.logging.log4j:log4j-1.2-apiTuxCare:Maven From an advisory covering 4 CVEs |
2.21.1 up to 2.21.1-tuxcare.1 | 2.21.1-tuxcare.1 |
org.apache.logging.log4j:log4j-apiTuxCare:Maven From an advisory covering 4 CVEs |
2.21.1 up to 2.21.1-tuxcare.1 | 2.21.1-tuxcare.1 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 4 CVEs |
2.21.1 up to 2.21.1-tuxcare.1 | 2.21.1-tuxcare.1 |
org.apache.logging.log4j:log4j-layout-template-jsonTuxCare:Maven From an advisory covering 4 CVEs |
2.21.1 up to 2.21.1-tuxcare.1 | 2.21.1-tuxcare.1 |
org.apache.logging.log4j:log4j-apiTuxCare:Maven From an advisory covering 2 CVEs |
2.24.1 up to 2.24.1-tuxcare.4, plus listed versions 2.24.1-tuxcare.12.24.1-tuxcare.22.24.1-tuxcare.3 |
2.24.1-tuxcare.4 |
org.apache.logging.log4j:log4j-coreTuxCare:Maven From an advisory covering 2 CVEs |
2.24.1 up to 2.24.1-tuxcare.4, plus listed versions 2.24.1-tuxcare.12.24.1-tuxcare.22.24.1-tuxcare.3 |
2.24.1-tuxcare.4 |
apache-log4j2Debian:12 |
All versions, plus listed versions 2.19.0-22.26.1-1 |
None known |
apache-log4j2Debian:13 |
All versions, plus listed versions 2.19.0-22.26.1-1 |
None known |
apache-log4j2Debian:14 |
All versions, plus listed versions 2.19.0-22.26.1-1 |
None known |
org.apache.logging.log4j:log4j-apiMaven |
2.13.1 up to 2.25.5, plus listed versions 2.13.22.13.32.14.02.14.12.15.0 Show 22 moreShow less2.16.02.17.02.17.12.17.22.18.02.19.02.20.02.21.02.21.12.22.02.22.12.23.02.23.12.24.02.24.12.24.22.24.32.25.02.25.12.25.22.25.32.25.4 |
2.25.5 |
log4jopenEuler:24.03-LTS-SP1 From an advisory covering 2 CVEs |
before 2.17.2-2.oe2403sp1 | 2.17.2-2.oe2403sp1 |
log4jopenEuler:24.03-LTS-SP3 From an advisory covering 2 CVEs |
before 2.17.2-2.oe2403sp3 | 2.17.2-2.oe2403sp3 |
log4jopenEuler:24.03-LTS-SP4 From an advisory covering 2 CVEs |
before 2.17.2-2.oe2403sp4 | 2.17.2-2.oe2403sp4 |
log4jopenEuler:20.03-LTS-SP4 From an advisory covering 2 CVEs |
before 2.17.0-5.oe2003sp4 | 2.17.0-5.oe2003sp4 |
log4jopenEuler:22.03-LTS-SP4 From an advisory covering 2 CVEs |
before 2.17.2-2.oe2203sp4 | 2.17.2-2.oe2203sp4 |
apache-log4j2Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.2-12.4-12.4-22.4-2ubuntu0.1~esm1 |
None known |
apache-log4j2Ubuntu:18.04:LTS |
All versions, plus listed versions 2.8.2-12.8.2-22.10.0-12.10.0-22.10.0-2ubuntu0.12.12.4-0ubuntu0.1 |
None known |
apache-log4j2Ubuntu:20.04:LTS |
All versions, plus listed versions 2.11.1-22.11.2-12.15.0-0.20.04.12.16.0-0.20.04.12.17.0-0.20.04.12.17.1-0.20.04.1 |
None known |
apache-log4j2Ubuntu:22.04:LTS |
All versions, plus listed versions 2.13.3-12.15.0-12.16.0-12.17.0-12.17.1-1 |
None known |
apache-log4j2Ubuntu:24.04:LTS |
All versions, plus listed versions 2.19.0-2 |
None known |
apache-log4j2Ubuntu:26.10 |
All versions, plus listed versions 2.19.0-2build1 |
None known |
apache-log4j2Ubuntu:26.04:LTS |
All versions, plus listed versions 2.19.0-22.19.0-2build1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | xiaoqiMikko/log4j-check | 2026-08-07 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts | OSV | |
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-49844 is a medium vulnerability (CVSS 6.3) in Apache Log4j, published July 10, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 48th percentile. Fixed in org.apache.logging.log4j:log4j-api 2.25.5.
References
logging.apache.org/log4j/2.x/manual/json-template-layout.html
github.com/apache/logging-log4j2/pull/4163
nvd.nist.gov/vuln/detail/CVE-2026-49844
Show 13 moreShow less
errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1784624635.html
repo.maven.apache.org/maven2
security-tracker.debian.org/tracker/CVE-2026-49844
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-3153
ubuntu.com/security/CVE-2026-49844
cve.org/CVERecord?id=CVE-2026-49844