CVE-2026-49844: 
Apache Log4j vulnerability analysis and mitigation

CVE-2026-49844 is an improper encoding vulnerability in Apache Log4j API that causes MapMessage.asJson() to emit non-RFC-8259-compliant JSON when processing non-finite IEEE 754 floating-point values (NaN, Infinity, or -Infinity). It affects Apache Log4j API versions 2.13.1 through 2.25.4, version 2.26.0, and pre-release 3.0.0 builds (alpha1 through beta2). The vulnerability was disclosed on July 10, 2026, and represents an incomplete fix for the related CVE-2026-34481. It carries a CVSS v3.1 score of 5.9 (Medium) and a CVSS v4.0 score of 6.3 (Medium) (Apache Advisory, GitHub Advisory).

The root cause is classified as CWE-116 (Improper Encoding or Escaping of Output). When MapMessage.asJson() serializes a floating-point value that is NaN, Infinity, or -Infinity, it emits the bare token directly into the JSON output rather than a compliant representation (e.g., a quoted string or null), violating RFC 8259. The defect is reachable only when two conditions are simultaneously met: (1) the application uses JsonTemplateLayout's message resolver or any layout relying on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}), and (2) the application logs a MapMessage containing an attacker-controlled floating-point value. The fix was implemented in pull request #4163 on the Log4j2 repository (GitHub PR, GitHub Advisory).

Successful exploitation allows an attacker who can supply a non-finite floating-point value to a logged MapMessage to corrupt the enclosing JSON log record, potentially disrupting downstream log ingestion pipelines, SIEM systems, or log parsers that rely on well-formed JSON. There is no confidentiality impact and no direct availability impact on the vulnerable system itself; the primary risk is integrity tampering of log data in subsequent systems (e.g., log aggregators or analytics platforms). This could undermine security monitoring, audit trails, and incident response capabilities that depend on reliable log data (Apache Advisory, GitHub Advisory).

1. Identify target application: Determine whether the target Java application uses Apache Log4j API versions 2.13.1–2.25.4 or 2.26.0 with JsonTemplateLayout (or any layout invoking MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}).
2. Find an attacker-controlled input path: Identify an application input (e.g., an API parameter, form field, or message body) that is logged as a floating-point value within a MapMessage.
3. Supply a non-finite floating-point value: Submit a payload containing a non-finite IEEE 754 value such as NaN, Infinity, or -Infinity through the identified input channel.
4. Trigger JSON serialization: Cause the application to log the MapMessage containing the non-finite value, which causes MapMessage.asJson() to emit a bare NaN, Infinity, or -Infinity token into the JSON log output.
5. Corrupt downstream log processing: The malformed JSON log record is forwarded to downstream log ingestion systems (e.g., Elasticsearch, Splunk, or a SIEM), where a conformant JSON parser rejects the document, disrupting log processing or creating gaps in audit trails (GitHub Advisory, GitHub PR).

• Logs: Log records containing bare NaN, Infinity, or -Infinity tokens in JSON-formatted log output (e.g., in files produced by JsonTemplateLayout); JSON parse errors or ingestion failures in downstream log aggregators (Elasticsearch, Splunk, Logstash) referencing malformed documents.
• Application Behavior: Downstream log ingestion pipeline errors or dropped log records coinciding with specific user inputs containing non-finite float values; alerts from log monitoring tools about invalid JSON documents.
• Network: Unusual or repeated API requests containing string representations of NaN, Infinity, or -Infinity in fields that are subsequently logged as floating-point values.

Apache has released patched versions 2.25.5 and 2.26.1 that emit RFC 8259-compliant JSON for non-finite floating-point values; users should upgrade to one of these versions as the primary remediation (Apache Advisory, GitHub Advisory). As a temporary workaround where immediate patching is not feasible, organizations should validate or sanitize floating-point values before they are logged in a MapMessage, ensuring non-finite values cannot reach the JSON serialization path. Additionally, switching from JsonTemplateLayout to a non-JSON layout for affected log configurations eliminates the vulnerable code path entirely.

The vulnerability received routine coverage across vulnerability tracking platforms and security community feeds shortly after disclosure on July 10, 2026, including posts on Bluesky and Mastodon's infosec community (infosec.exchange). IBM published a support advisory acknowledging the issue in their products (IBM Advisory). Community reaction has been measured given the moderate severity and limited exploitability; the vulnerability is notable primarily as an incomplete fix for a prior CVE (CVE-2026-34481) rather than a novel attack class.