Apache-Log4j2-RCE

Apache Log4j2 RCE Verification Environment Since from 2021.12.09 Some References https://mp.weixin.qq.com/s/yck74F9p9QhVw3ykzVoSg Setting up the Environment Maven introduces related packages and vulnerable version range org.apache.logging.log4j log4j-api 2.14.1 org.apache.logging.log4j log4j-core...

Security Bulletin: IBM Guardium Data Protection is affected by a security vulnerability (CVE-2026-49844).

Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This...

CLEANSTART-2026-OB90229 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

Security vulnerability affects the apache-nifi package. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON...

Security Bulletin: IBM® Db2® federated server is affected by a vulnerability in log4j (CVE-2026-49844)

Summary IBM® Db2® federated server is affected by a vulnerability in log4j. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue...

CLEANSTART-2026-PZ72315 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

CVE-2026-49844 affects multiple packages. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...

CLEANSTART-2026-SN07875 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

CVE-2026-49844 affects multiple packages. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...

CLEANSTART-2026-ON00136 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

Security vulnerability affects the sonarqube package. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON...

CLEANSTART-2026-KK56976 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

CVE-2026-49844 affects multiple packages. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...

Security Bulletin: IBM Maximo Application Suite uses log4j-api-2.25.4.jar which is vulnerable to CVE-2026-49844

Summary IBM Maximo Application Suite uses log4j-api-2.25.4.jar which is vulnerable to CVE-2026-49844. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values durin...

CLEANSTART-2026-PP78809 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

CVE-2026-49844 affects multiple packages. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. See references for individual vulnerability details...

Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover all code paths: wh...

Security Bulletin: Vulnerability in Apache Log4j API affects DB2 Dev Extension (CVE-2026-49844)

Summary Upgraded log4j-api to 2.25.5 to remediate CVE-2026-49844 CWE-116: Improper Encoding of non-finite floating-point values in MapMessage JSON serialization — CVSS Base Score 6.3 Medium — PVR0815934. Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite...

Security Bulletin: Multiple security vulnerabilities are addressed with IBM Content Management Interoperability Services(CMIS) 3.0.7-IF15

Summary IBM Content Management Interoperability ServicesCMIS 3.0.7-IF15 addresses CVEs related to log4j, neethi and cxf in v3.0.7-IF15 Vulnerability Details CVEID:CVE-2026-49844 DESCRIPTION: Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j...

CVE-2026-49844

A flaw was found in Apache Log4j API. This vulnerability occurs due to improper encoding of non-finite floating-point values during JSON serialization of MapMessages, leading to invalid JSON output. An attacker who can supply a non-finite value can exploit this to cause the affected logging layou...

OESA-2026-3153 log4j security update

Log4j is a tool to help the programmer output log statements to a variety of output targets. Security Fixes: Apache Log4j's JsonTemplateLayout in versions up to and including 2.25.3 produces invalid JSON output when log events contain non-finite floating-point values NaN, Infinity, or -Infinity,...

ai.philterd:phileas (>=4.0.0, <=4.4.0), ai.philterd:phileas-pheye-onnx (1.0.0) +1736 more potentially affected by CVE-2026-49844 via org.apache.logging.log4j:log4j-api (2.26.0)

org.apache.logging.log4j:log4j-api MAVEN version 2.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.logging.log4j:log4j-api and may be impacted: - ai.philterd:phileas =4.0.0, =1.0.0.ee-20260711132804, =1.0.0.ee-20260711132804,...

EUVD-2026-43102

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover all code paths: wh...

ai.philterd:phileas (>=4.0.0, <=4.4.0), ai.philterd:phileas-pheye-onnx (1.0.0) +1736 more potentially affected by CVE-2026-49844 via org.apache.logging.log4j:log4j-api (2.26.0)

org.apache.logging.log4j:log4j-api MAVEN version 2.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.logging.log4j:log4j-api and may be impacted: - ai.philterd:phileas =4.0.0, =1.0.0.ee-20260711132804, =1.0.0.ee-20260711132804,...

bg.codexio.ai:openai-api-examples (>=0.8.0.beta-jdk17, <=0.9.0.beta), cloud.metaapi.sdk:metaapi-common-java (>=1.0.0, <=1.0.1) +269 more potentially affected by CVE-2026-49844 via org.apache.logging.log4j:log4j-api (>=3.0.0-alpha1, <=3.0.0-beta2)

org.apache.logging.log4j:log4j-api MAVEN version =3.0.0-alpha1, =0.8.0.beta-jdk17, =1.0.0, =2.4.0, =1.0.6, =1.0.0, =1.3.3, =1.0.0, =1.0.7, =1.0.6, =1.0.6, =1.0.1, =1.0.1, =1.0.0, =1.0.0, =1.0.3 and more Source cves: CVE-2026-49844 Source advisory: SNYK:JAVA-ORGAPACHELOGGINGLOG4J-17954276...

DEBIAN-CVE-2026-49844

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover all code paths: wh...