OESA-2026-3153 log4j security update

Log4j is a tool to help the programmer output log statements to a variety of output targets. Security Fixes: Apache Log4j's JsonTemplateLayout in versions up to and including 2.25.3 produces invalid JSON output when log events contain non-finite floating-point values NaN, Infinity, or -Infinity,...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Apache Log4j

Summary Multiple vulnerabilities in Apache Log4j that is used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostname verificati...

Oracle Essbase (July 2026 CPU)

The version of Oracle Essbase installed on the remote host is missing a security patch from the July 2026 Critical Patch Update CPU. It is, therefore, affected by: - Apache Log4j's JsonTemplateLayout, in versions up to and including 2.25.3, produces invalid JSON output when log events contain...

Oracle WebLogic Server Apache Log4j (July 2026 CPU) (12.2.1.4.0)

The 12.2.1.4.0 version of WebLogic Server installed on the remote host is affected by a vulnerability as referenced in the July 2026 CPU advisory. - Apache Log4j Core's XmlLayout, in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification, producin...

Oracle Primavera Unifier (July 2026 CPU)

The versions of Primavera Unifier installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the Primavera Unifier product of Oracle Construction and Engineering component: Integration Lodash. Supported versions that are...

Oracle Primavera Gateway (July 2026 CPU)

The version of Primavera Gateway installed on the remote host is affected by a vulnerability as referenced in the July 2026 CPU advisory. - Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering component: Admin Apache Log4j. Supported versions that are affected are...

Security Bulletin: IBM Engineering Systems Design Rhapsody was affected by Vulnerability in log4j

Summary Security Bulletin: IBM Engineering Systems Design Rhapsody was affected by Vulnerability in log4j. Even though Rhapsody risk impact was low We have addressed these Vulnerability on our latest iFIx for all versions. Vulnerability Details CVEID:CVE-2025-68161 DESCRIPTION: The Socket Appende...

Security Bulletin: IBM® Db2® federated server is affected by a vulnerability in log4j-core (CVE-2026-34479)

Summary IBM® Db2® federated server is affected by a vulnerability in log4j-core. Vulnerability Details CVEID:CVE-2026-34479 DESCRIPTION: The Log4j1XmlLayout from the Apache Log4j 1-to-Log4j 2 bridge fails to escape characters forbidden by the XML 1.0 standard, producing malformed XML output...

Apache Log4j 2.13.1 < 2.25.5 / 2.26.0 < 2.26.1 Improper JSON Serialization (CVE-2026-49844)

The version of Apache Log4j on the remote host is affected by a vulnerability: - Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. When a MapMessage contains a non-finite IEEE 754 value NaN,...

Security Bulletin: Multiple Vulnerabilities in IBM Datacap

Summary Multiple vulnerabilities were addressed in IBM Datacap version 9.1.10 released on December 19, 2025 and IBM Datacap version 9.1.9 Interim Fix 008 released on June 15, 2026 Vulnerability Details CVEID:CVE-2022-23302 DESCRIPTION: JMSSink in all versions of Log4j 1.x is vulnerable to...

Apache Log4j2 - Remote Code Injection

Apache Log4j2 Thread Context Lookup Pattern is vulnerable to remote code execution in certain non-default configurations. id: CVE-2021-45046 info: name: Apache Log4j2 - Remote Code Injection author: ImNightmaree severity: critical description: Apache Log4j2 Thread Context Lookup Pattern is...

Security Bulletin: Multiple vulnerabilities in IBM Disconnected Log Collector

Summary Multiple vulnerable packages were addressed in IBM Disconnected Log Collector version 2.0.1 Vulnerability Details CVEID:CVE-2025-66566 DESCRIPTION: yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in...

Security Bulletin: Multiple log4j related security vulnerabilities in IBM Guardium Key Lifecycle Manager

Summary Multiple security vulnerabilities related to log4j have been addressed in IBM Guardium Key Lifecycle Manager Vulnerability Details CVEID:CVE-2026-34477 DESCRIPTION: The fix for CVE-2025-68161 https://logging.apache.org/security.htmlCVE-2025-68161 was incomplete: it addressed hostname...

EUVD-2026-43102

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover all code paths: wh...

DEBIAN-CVE-2026-49844

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover all code paths: wh...

CVE-2026-49844

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover all code paths: wh...

UBUNTU-CVE-2026-49844

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover all code paths: wh...

CVE-2026-49844 Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover all code paths: wh...

CVE-2026-49844

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover all code paths: wh...

CVE-2026-49844

CVE-2026-49844 describes an issue in the Apache Log4j API where MapMessage.asJson() can emit non-finite IEEE 754 values (NaN, Infinity, -Infinity) as bare tokens during JSON serialization. This affects Log4j API versions 2.13.1–2.25.4 and 2.26.0. The fault occurs when a MapMessage contains an att...