Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization

🗓️ 11 Jul 2026 00:31:48Reported by GitHub Advisory DatabaseType

Log4j API 2.13.1-2.26.0 emits invalid JSON for NaN or Infinity values in MapMessage serialization.

Reporter	Title	Published	Views	Family All 180
IBM Security Bulletins	Security Bulletin: IBM Operations Analytics - Log Analysis is affected by an Improper Serialization due to Apache Log4j JSON Template Layout	17 Aug 202611:45	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in Log4j affects IBM Netezza Appliance	12 Aug 202609:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Apache Log4j Core shipped in Tivoli Netcool/OMNIbus	29 May 202612:15	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Event Streams	22 Jul 202606:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.	30 Jul 202615:33	–	ibm
Tenable Nessus	Apache Log4j 2.13.1 < 2.25.5 / 2.26.0 < 2.26.1 Improper JSON Serialization (CVE-2026-49844)	17 Jul 202600:00	–	nessus
Tenable Nessus	Oracle Business Process Management Suite (12.2.1.4.0 / 14.1.2.0.0) (July 2026 CPU)	22 Jul 202600:00	–	nessus
Tenable Nessus	Oracle Coherence (July 2026 CPU)	22 Jul 202600:00	–	nessus
Tenable Nessus	Oracle Enterprise Manager Cloud Control (June 2026 CSPU)	19 Jun 202600:00	–	nessus
Tenable Nessus	Oracle Primavera Gateway (July 2026 CPU)	23 Jul 202600:00	–	nessus

Vulners

Node

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-49844
github	www.github.com/apache/logging-log4j2/pull/4163
logging	www.logging.apache.org/cyclonedx/vdr.xml
logging	www.logging.apache.org/log4j/2.x/manual/json-template-layout.html
logging	www.logging.apache.org/security.html
github	www.github.com/apache/logging-log4j2/commit/19edb23e162d6c728a8c2221a240037d389ed300
github	www.github.com/apache/logging-log4j2/commit/feadf8eb0b4acb6ddfa4c0ab2bbc6d88b8e12d82
github	www.github.com/apache/logging-log4j2/releases/tag/rel/2.25.5
github	www.github.com/apache/logging-log4j2/releases/tag/rel/2.26.1
github	www.github.com/advisories/GHSA-qv9r-c865-cp47

13 Aug 2026 18:28Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.17.5

CVSS 46.3

EPSS0.00691

SSVC