CVE-2026-49844: Apache Log4j API Improper Encoding Of Non-finite Floating-point Vulnerability

MODERATE
Advisory Identifier: GHSA-qv9r-c865-cp47
Share
CWE-116
Published
Advisory Summary

CVE-2026-49844 is a MODERATE improper encoding of non-finite floating-point vulnerability (CWE-116: Improper Encoding or Escaping of Output) affecting Apache Log4j API libraries in the Maven ecosystem. The issue involves improper encoding of non-finite floating-point values during mapmessage json serialization. Remediation is available by upgrading affected packages to version 2.25.5, 2.26.1.

CVE-2026-49844 at a Glance

CVE Identifier CVE-2026-49844
GHSA Identifier GHSA-qv9r-c865-cp47
Severity MODERATE
CVSS v3.1 Base Score N/A
CWE Classification CWE-116: Improper Encoding or Escaping of Output
Affected Product Apache Log4j API
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-49844

To remediate this vulnerability, upgrade all affected Apache Log4j API dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

org.apache.logging.log4j:log4j-api fixed: 2.25.5 
<dependency>
    <groupId>org.apache.logging.log4j</groupId>
    <artifactId>log4j-api</artifactId>
    <version>2.25.5</version>
</dependency>
org.apache.logging.log4j:log4j-api fixed: 2.26.1 
<dependency>
    <groupId>org.apache.logging.log4j</groupId>
    <artifactId>log4j-api</artifactId>
    <version>2.26.1</version>
</dependency>
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree -Dincludes=org.apache.logging.log4j

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-49844, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree -Dincludes=org.apache.logging.log4j

Analyze the terminal output to locate any version of Apache Log4j API in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.25.5), your application is affected.

Note: The mvn dependency:tree -Dincludes=org.apache.logging.log4j command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-116: Improper Encoding or Escaping of Output, where the product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. as a result, the intended structure of the message is not preserved. In Apache Log4j API, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document. The defect is reachable only when both of the following conditions hold: * The application uses the message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}). * The application logs a MapMessage that contains an attacker-controlled floating-point value. An attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing. Users are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.

CVE-2026-49844 Affected Apache Log4j API Versions

2 component(s)
Fixed Versions:
2.25.52.26.1
Product / Package Ecosystem Affected Versions Fixed Version
org.apache.logging.log4j:log4j-api
maven/org.apache.logging.log4j/log4j-api
Maven
≥ 2.13.1
< 2.25.5
2.25.5
org.apache.logging.log4j:log4j-api
maven/org.apache.logging.log4j/log4j-api
Maven
≥ 2.26.0
< 2.26.1
2.26.1

References

NVD — CVE-2026-49844 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-49844
Apache Log4j API Source Repository REPOSITORY
https://github.com/apache/logging-log4j2/pull/4163
Security Fix Commit FIX COMMIT
https://github.com/apache/logging-log4j2/commit/19edb23e162d6c728a8c2221a240037d389ed300
Security Fix Commit FIX COMMIT
https://github.com/apache/logging-log4j2/commit/feadf8eb0b4acb6ddfa4c0ab2bbc6d88b8e12d82
Apache Log4j API Source Repository REPOSITORY
https://github.com/apache/logging-log4j2
Apache Log4j API Release RELEASE
https://github.com/apache/logging-log4j2/releases/tag/rel/2.25.5
Apache Log4j API Release RELEASE
https://github.com/apache/logging-log4j2/releases/tag/rel/2.26.1
logging.apache.org/cyclonedx/vdr.xml WEB
https://logging.apache.org/cyclonedx/vdr.xml
logging.apache.org/log4j/2.x/manual/js... WEB
https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message
Apache Log4j API Security Information SECURITY
https://logging.apache.org/security.html#CVE-2026-49844

Frequently Asked Questions

What is CVE-2026-49844?
CVE-2026-49844 is a security vulnerability in Apache Log4j API involving Improper encoding of non-finite floating-point values during MapMessage JSON serialization under CWE-116: Improper Encoding or Escaping of Output.
Which Apache Log4j API versions are affected?
Affected versions include releases prior to 2.25.5, 2.26.1 across affected packages: org.apache.logging.log4j:log4j-api.
What version fixes CVE-2026-49844?
Upgrading to 2.25.5, 2.26.1 (or the latest patched release for your respective branch) resolves the vulnerability.
Is log4j-api affected?
Yes, org.apache.logging.log4j:log4j-api is affected in releases prior to 2.25.5, 2.26.1. Upgrade your dependency to 2.25.5, 2.26.1 or later.
What CWE is associated with CVE-2026-49844?
CVE-2026-49844 is classified under CWE-116: Improper Encoding or Escaping of Output (The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.).
How can I check Maven dependencies for CVE-2026-49844?
Run the dependency tree command: 'mvn dependency:tree -Dincludes=org.apache.logging.log4j'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-qv9r-c865-cp47",
  "modified" : "2026-08-13T18:28:30Z",
  "published" : "2026-07-11T00:31:48Z",
  "aliases" : [ "CVE-2026-49844" ],
  "summary" : "Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization",
  "details" : "Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.\n\nThe fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.\n\nThe defect is reachable only when both of the following conditions hold:\n\n  *  The application uses the  message resolver https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message  of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{\"JSON\"}).\n  *  The application logs a MapMessage that contains an attacker-controlled floating-point value.\n\n\nAn attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.\n\nUsers are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.logging.log4j:log4j-api"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.13.1"
      }, {
        "fixed" : "2.25.5"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.apache.logging.log4j:log4j-api"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.26.0"
      }, {
        "fixed" : "2.26.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-49844"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/logging-log4j2/pull/4163"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/logging-log4j2/commit/19edb23e162d6c728a8c2221a240037d389ed300"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/logging-log4j2/commit/feadf8eb0b4acb6ddfa4c0ab2bbc6d88b8e12d82"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/apache/logging-log4j2"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/logging-log4j2/releases/tag/rel/2.25.5"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/apache/logging-log4j2/releases/tag/rel/2.26.1"
  }, {
    "type" : "WEB",
    "url" : "https://logging.apache.org/cyclonedx/vdr.xml"
  }, {
    "type" : "WEB",
    "url" : "https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message"
  }, {
    "type" : "WEB",
    "url" : "https://logging.apache.org/security.html#CVE-2026-49844"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-116" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-08-13T18:28:30Z",
    "nvd_published_at" : "2026-07-10T22:16:42Z"
  }
}