CVE-2026-49844: Apache Log4j JSON Encoding Vulnerability

CVE-2026-49844 Overview

CVE-2026-49844 affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The flaw stems from improper output encoding [CWE-116] in MapMessage.asJson() when serializing non-finite IEEE 754 floating-point values. When a MapMessage contains NaN, Infinity, or -Infinity, the layout emits bare tokens that RFC 8259 does not permit. A conformant JSON parser rejects the resulting document.

The fix for CVE-2026-34481 did not cover all code paths, leaving JsonTemplateLayout and other layouts relying on MapMessage.asJson() exposed. An attacker who supplies a non-finite floating-point value can corrupt log records and disrupt downstream log ingestion.

Critical Impact
Attacker-controlled non-finite floating-point values can produce malformed JSON log output, corrupting log records and breaking downstream SIEM and log parsing pipelines.

Affected Products

Apache Log4j API versions 2.13.1 through 2.25.4
Apache Log4j API version 2.26.0
Applications using JsonTemplateLayout with the message resolver or layouts relying on MapMessage.asJson()

Discovery Timeline

2026-07-10 - CVE-2026-49844 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-49844

Vulnerability Analysis

The defect resides in Apache Log4j API's MapMessage serialization logic. When the logging pipeline invokes MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}), the encoder writes non-finite IEEE 754 values as the literal tokens NaN, Infinity, or -Infinity. RFC 8259 prohibits these tokens in JSON documents. Any strict downstream parser rejects the malformed output.

This issue is a regression scope gap from CVE-2026-34481. That earlier fix addressed some serialization paths but did not sanitize all code paths that reach non-finite float encoding. The result is a partial fix that continues to emit invalid JSON under specific inputs.

Exploitation requires two conditions. First, the application must use the message event template resolver of JsonTemplateLayout, or any layout that calls MapMessage.asJson(). Second, the application must log a MapMessage containing an attacker-controlled floating-point value. Java expressions such as Double.parseDouble("NaN") or arithmetic like 1.0/0.0 produce the offending values.

Root Cause

The root cause is improper output neutralization during structured log encoding. The serializer does not translate non-finite doubles into RFC 8259-compliant representations such as null or a quoted string. Instead, it delegates to Java's default numeric formatting, which emits bare unquoted tokens.

Attack Vector

The attack vector is network-reachable input that flows into a logged MapMessage field typed as a floating-point number. An attacker submits a value that Java parses to NaN or Infinity. The affected layout emits invalid JSON. Downstream ingestion fails, log records drop, or subsequent structured fields become unparseable, producing an integrity impact on the logging pipeline.

No verified exploit code is publicly available. Refer to the Apache Security Advisory CVE-2026-49844 and the GitHub Pull Request for the technical fix.

Detection Methods for CVE-2026-49844

Indicators of Compromise

Log ingestion errors or parser failures referencing unexpected tokens NaN, Infinity, or -Infinity in JSON log streams
Truncated or dropped log events in downstream SIEM pipelines originating from applications using JsonTemplateLayout
Sudden gaps in structured log delivery correlated with user-supplied numeric input

Detection Strategies

Inventory Java applications and identify Log4j API versions in the 2.13.1 through 2.25.4 range and version 2.26.0 using software composition analysis
Scan configuration files for JsonTemplateLayout with the message event template resolver or explicit calls to MapMessage.asJson()
Grep centralized log storage for the literal tokens NaN, Infinity, or -Infinity appearing outside of quoted strings

Monitoring Recommendations

Alert on JSON parse failures in log ingestion services such as Fluentd, Logstash, and Vector
Track application inputs that carry floating-point values into logged MapMessage fields
Monitor Apache Log4j advisories through the Apache CycloneDX XML Resource for supply chain awareness

How to Mitigate CVE-2026-49844

Immediate Actions Required

Upgrade Apache Log4j API to version 2.25.5 or 2.26.1, which emit RFC 8259-compliant JSON for non-finite values
Audit applications for use of JsonTemplateLayout message resolver and direct calls to MapMessage.asJson()
Validate and sanitize floating-point inputs at application boundaries to reject NaN and infinite values where not required

Patch Information

Apache addressed CVE-2026-49844 in Log4j API 2.25.5 and 2.26.1. Both releases encode non-finite doubles in RFC 8259-compliant form. Review the GitHub Pull Request for the code-level fix and the Apache Security Advisory CVE-2026-49844 for release guidance.

Workarounds

Avoid logging attacker-controlled floating-point values in MapMessage structures until patched
Replace JsonTemplateLayout message resolver usage with a layout that does not invoke MapMessage.asJson() where feasible
Introduce a pre-log validation step that rejects or converts non-finite floating-point values using Double.isFinite() checks

bash

# Maven dependency upgrade example
# Update pom.xml to a fixed Log4j API version
<dependency>
  <groupId>org.apache.logging.log4j</groupId>
  <artifactId>log4j-api</artifactId>
  <version>2.25.5</version>
</dependency>

# Verify the resolved version
mvn dependency:tree | grep log4j-api