CVE-2026-34481: 
Java vulnerability analysis and mitigation

CVE-2026-34481 is an improper serialization vulnerability in Apache Log4j's JsonTemplateLayout component that causes invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This can allow an attacker to corrupt downstream log processing pipelines, causing them to reject or fail to index affected log records. Affected versions include Apache Log4j JSON Template Layout (org.apache.logging.log4j:log4j-layout-template-json) 2.14.0 through 2.25.3, and 3.0.0-alpha1 through 3.0.0-beta3. The vulnerability was reported on 2026-02-16 by researchers Ap4sh (Samy Medjahed) and Ethicxz (Eliott Laurie), with a fix released on 2026-03-28 and publicly disclosed on 2026-04-10. The CVSS v4.0 base score is 6.3 (Medium), while NVD independently assigned a CVSS v3.1 score of 7.5 (High) — a discrepancy noted by the Apache maintainers (Github Advisory, Openwall OSS-Sec).

The root cause is classified as CWE-116 (Improper Encoding or Escaping of Output): the JsonWriter class in the log4j-layout-template-json module emitted non-finite floating-point values (NaN, Infinity, -Infinity) as bare unquoted tokens, which are not valid JSON number literals per RFC 8259. The fix, implemented in pull request #4080, updates JsonWriter to serialize these values as quoted JSON strings (e.g., "NaN"), aligning behavior with Jackson's JsonWriteFeature#WRITE_NAN_AS_STRINGS (GitHub PR #4080). Exploitation requires two preconditions: (1) the application must be configured to use JsonTemplateLayout, and (2) the application must log a MapMessage that includes an attacker-controlled floating-point value. The attack vector is network-based, requiring no authentication or user interaction, but the attack complexity is high due to these specific preconditions (Github Advisory, Openwall OSS-Sec).

Successful exploitation degrades the integrity of log data in downstream systems — such as SIEMs, log aggregators, or indexing pipelines — by injecting malformed JSON records that those systems may reject or silently drop. This reduces observability and can blind security monitoring tools to attacker activity occurring concurrently. There is no direct impact on confidentiality or availability of the vulnerable application itself; the primary risk is to the integrity and completeness of log data in subsequent processing systems (Github Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory). The EPSS score is approximately 0.057% (17th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The high attack complexity and specific preconditions (use of JsonTemplateLayout with attacker-controlled MapMessage float values) significantly limit the exploitable attack surface (Github Advisory, Openwall OSS-Sec).

1. Reconnaissance: Identify applications using Apache Log4j versions 2.14.0–2.25.3 or 3.0.0-alpha1–3.0.0-beta3 that are configured with JsonTemplateLayout for structured JSON logging.
2. Identify input vector: Find an application endpoint or input channel where user-supplied data is passed into a MapMessage that is subsequently logged — for example, a REST API that logs request parameters as a MapMessage.
3. Craft malicious payload: Submit a floating-point value of NaN, Infinity, or -Infinity as the attacker-controlled field in the MapMessage. In Java, these can be represented as the string literals NaN, Infinity, or -Infinity if the application parses them as floats.
4. Trigger log corruption: When the application logs the MapMessage via JsonTemplateLayout, the JsonWriter emits the non-finite value as an unquoted token, producing invalid JSON (e.g., {"value": NaN}).
5. Impact downstream systems: The malformed JSON log record is forwarded to downstream log processors (e.g., Elasticsearch, Splunk, Logstash), which reject or fail to index the record, potentially suppressing visibility into attacker activity or causing log pipeline errors (Github Advisory, GitHub PR #4080).

• Logs: Log pipeline errors or parse failures in downstream systems (e.g., Elasticsearch, Splunk, Logstash) referencing invalid JSON tokens such as NaN, Infinity, or -Infinity in records originating from the affected application.
• Logs: Application log files containing raw JSON entries with unquoted non-finite float values, e.g., {"key": NaN} or {"key": Infinity}, which fail JSON schema validation.
• Network: Unusual or repeated requests to application endpoints that accept floating-point input parameters, particularly with values that parse to NaN or Infinity in Java.
• File System: No file-system artifacts are expected, as this vulnerability does not involve code execution or file writes.

The primary remediation is to upgrade the log4j-layout-template-json artifact to version 2.25.4 (for the 2.x branch) or 3.0.0-RC1 or later (for the 3.x branch), which serializes non-finite floating-point values as quoted JSON strings (Github Advisory, Openwall OSS-Sec). As a workaround where immediate upgrade is not possible, implement input validation to reject or sanitize floating-point values that resolve to NaN, Infinity, or -Infinity before they are passed into MapMessage objects that are logged. Organizations using IBM watsonx.data should consult the IBM security bulletin for product-specific guidance (IBM Advisory). SUSE Linux users should apply the vendor-provided package updates (SUSE Advisory).

The Apache Log4j maintainer (ppkarwasz) publicly noted that NVD independently assigned a higher CVSS v3.1 score of 7.5 (High) by lowering attack complexity and raising integrity impact, contrary to the intentional CVSS 4.0 score of 6.3 (Medium) published by Apache — a discrepancy the maintainer attributed to NVD's independent enrichment process and incorrect CPE assignment (GitHub PR #4080). The maintainer explicitly stated that Apache published a CVSS 4.0 score to prevent score inflation and recommended that organizations source vulnerability data directly from the CVE database or GitHub Advisories rather than NVD. Community commentary on the GitHub pull request reflected frustration with NVD's scoring practices and the downstream effects on vulnerability management tooling.