CVE-2026-34481

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34481", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-03-28T19:23:37.127Z", "datePublished": "2026-04-10T15:43:00.100Z", "dateUpdated": "2026-07-11T04:55:42.502Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://repo.maven.apache.org/maven2", "cpes": ["cpe:2.3:a:apache:log4j_layout_template_json:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "org.apache.logging.log4j:log4j-layout-template-json", "packageURL": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json", "product": "Apache Log4j JSON Template Layout", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "2.25.4", "status": "affected", "version": "2.14.0", "versionType": "maven"}, {"lessThanOrEqual": "3.0.0-beta3", "status": "affected", "version": "3.0.0-alpha1", "versionType": "maven"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Ap4sh (Samy Medjahed) and Ethicxz (Eliott Laurie)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Apache Log4j's <code><a target=\"_blank\" rel=\"nofollow\" href=\"https://logging.apache.org/log4j/2.x/manual/json-template-layout.html\">JsonTemplateLayout</a></code>, in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (<code>NaN</code>, <code>Infinity</code>, or <code>-Infinity</code>), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.</p><p>An attacker can exploit this issue only if both of the following conditions are met:</p><ul><li>The application uses <code>JsonTemplateLayout</code>.</li><li>The application logs a <code>MapMessage</code>, or logs an object directly (e.g., via <code>Logger.info(Object)</code>, which wraps it in an <code>ObjectMessage</code>), where the message contains an attacker-controlled floating-point value.</li></ul><p>Users are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue.</p><p><strong>Note:</strong> The fix released in version 2.25.4 did not cover all affected code paths. CVE-2026-49844 was assigned to the remaining issue, which concerns the <code>MapMessage.asJson()</code> serialization in Apache Log4j API and is fixed in versions 2.25.5 and 2.26.1.</p>"}], "value": "Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.\n\nAn attacker can exploit this issue only if both of the following conditions are met:\n\n * The application uses JsonTemplateLayout.\n * The application logs a MapMessage, or logs an object directly (e.g., via Logger.info(Object), which wraps it in an ObjectMessage), where the message contains an attacker-controlled floating-point value.\n\n\nUsers are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue.\n\nNote: The fix released in version 2.25.4 did not cover all affected code paths. CVE-2026-49844 was assigned to the remaining issue, which concerns the MapMessage.asJson() serialization in Apache Log4j API and is fixed in versions 2.25.5 and 2.26.1."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"other": {"content": {"text": "moderate"}, "type": "Textual description of severity"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-116", "description": "CWE-116 Improper Encoding or Escaping of Output", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-07-11T04:55:42.502Z"}, "references": [{"tags": ["patch"], "url": "https://github.com/apache/logging-log4j2/pull/4080"}, {"tags": ["vendor-advisory"], "url": "https://logging.apache.org/security.html#CVE-2026-34481"}, {"tags": ["vendor-advisory"], "url": "https://logging.apache.org/cyclonedx/vdr.xml"}, {"tags": ["related"], "url": "https://logging.apache.org/log4j/2.x/manual/json-template-layout.html"}, {"tags": ["vendor-advisory"], "url": "https://lists.apache.org/thread/n34zdv00gbkdbzt2rx9rf5mqz6lhopcv"}], "source": {"discovery": "EXTERNAL"}, "timeline": [{"lang": "en", "time": "2026-02-16T18:14:00.000Z", "value": "Vulnerability reported by Ap4sh and ethicxz"}, {"lang": "en", "time": "2026-03-10T20:42:00.000Z", "value": "Candidate patch internally shared by Piotr P. Karwasz"}, {"lang": "en", "time": "2026-03-24T23:06:00.000Z", "value": "Fix shared publicly by Piotr P. Karwasz as pull request #4080"}, {"lang": "en", "time": "2026-03-25T09:54:00.000Z", "value": "Fix verified by the reporter"}, {"lang": "en", "time": "2026-03-28T11:19:00.000Z", "value": "Log4j 2.25.4 released"}], "title": "Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/10/10"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-10T16:18:20.891Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-10T17:41:23.224802Z", "id": "CVE-2026-34481", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T17:41:38.229Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/04/10/10"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-04-10T16:18:20.891Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34481", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-10T17:41:23.224802Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-10T17:41:31.864Z"}}], "cna": {"title": "Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Ap4sh (Samy Medjahed) and Ethicxz (Eliott Laurie)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"other": {"type": "Textual description of severity", "content": {"text": "moderate"}}}], "affected": [{"cpes": ["cpe:2.3:a:apache:log4j_layout_template_json:*:*:*:*:*:*:*:*"], "vendor": "Apache Software Foundation", "product": "Apache Log4j JSON Template Layout", "versions": [{"status": "affected", "version": "2.14.0", "lessThan": "2.25.4", "versionType": "maven"}, {"status": "affected", "version": "3.0.0-alpha1", "versionType": "maven", "lessThanOrEqual": "3.0.0-beta3"}], "packageURL": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json", "packageName": "org.apache.logging.log4j:log4j-layout-template-json", "collectionURL": "https://repo.maven.apache.org/maven2", "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-16T18:14:00.000Z", "value": "Vulnerability reported by Ap4sh and ethicxz"}, {"lang": "en", "time": "2026-03-10T20:42:00.000Z", "value": "Candidate patch internally shared by Piotr P. Karwasz"}, {"lang": "en", "time": "2026-03-24T23:06:00.000Z", "value": "Fix shared publicly by Piotr P. Karwasz as pull request #4080"}, {"lang": "en", "time": "2026-03-25T09:54:00.000Z", "value": "Fix verified by the reporter"}, {"lang": "en", "time": "2026-03-28T11:19:00.000Z", "value": "Log4j 2.25.4 released"}], "references": [{"url": "https://github.com/apache/logging-log4j2/pull/4080", "tags": ["patch"]}, {"url": "https://logging.apache.org/security.html#CVE-2026-34481", "tags": ["vendor-advisory"]}, {"url": "https://logging.apache.org/cyclonedx/vdr.xml", "tags": ["vendor-advisory"]}, {"url": "https://logging.apache.org/log4j/2.x/manual/json-template-layout.html", "tags": ["related"]}, {"url": "https://lists.apache.org/thread/n34zdv00gbkdbzt2rx9rf5mqz6lhopcv", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.\n\nAn attacker can exploit this issue only if both of the following conditions are met:\n\n * The application uses JsonTemplateLayout.\n * The application logs a MapMessage, or logs an object directly (e.g., via Logger.info(Object), which wraps it in an ObjectMessage), where the message contains an attacker-controlled floating-point value.\n\n\nUsers are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue.\n\nNote: The fix released in version 2.25.4 did not cover all affected code paths. CVE-2026-49844 was assigned to the remaining issue, which concerns the MapMessage.asJson() serialization in Apache Log4j API and is fixed in versions 2.25.5 and 2.26.1.", "supportingMedia": [{"type": "text/html", "value": "<p>Apache Log4j's <code><a target=\"_blank\" rel=\"nofollow\" href=\"https://logging.apache.org/log4j/2.x/manual/json-template-layout.html\">JsonTemplateLayout</a></code>, in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (<code>NaN</code>, <code>Infinity</code>, or <code>-Infinity</code>), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.</p><p>An attacker can exploit this issue only if both of the following conditions are met:</p><ul><li>The application uses <code>JsonTemplateLayout</code>.</li><li>The application logs a <code>MapMessage</code>, or logs an object directly (e.g., via <code>Logger.info(Object)</code>, which wraps it in an <code>ObjectMessage</code>), where the message contains an attacker-controlled floating-point value.</li></ul><p>Users are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue.</p><p><strong>Note:</strong> The fix released in version 2.25.4 did not cover all affected code paths. CVE-2026-49844 was assigned to the remaining issue, which concerns the <code>MapMessage.asJson()</code> serialization in Apache Log4j API and is fixed in versions 2.25.5 and 2.26.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116 Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-07-11T04:55:42.502Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34481", "state": "PUBLISHED", "dateUpdated": "2026-07-11T04:55:42.502Z", "dateReserved": "2026-03-28T19:23:37.127Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-04-10T15:43:00.100Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://repo.maven.apache.org/maven2", "cpes": ["cpe:2.3:a:apache:log4j_layout_template_json:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "packageName": "org.apache.logging.log4j:log4j-layout-template-json", "packageURL": "pkg:maven/org.apache.logging.log4j/log4j-layout-template-json", "product": "Apache Log4j JSON Template Layout", "vendor": "Apache Software Foundation", "versions": [{"lessThan": "2.25.4", "status": "affected", "version": "2.14.0", "versionType": "maven"}, {"lessThanOrEqual": "3.0.0-beta3", "status": "affected", "version": "3.0.0-alpha1", "versionType": "maven"}]}], "source": "security@apache.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:apache:log4j:*:*:*:*:*:*:*:*", "matchCriteriaId": "FED62F2E-60EF-45CB-9F07-F6904145C372", "versionEndExcluding": "2.25.4", "versionStartIncluding": "2.14.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:log4j:3.0.0:alpha1:*:*:*:*:*:*", "matchCriteriaId": "5EE518C3-2F43-40FF-B754-C340B7003FC7", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc1:*:*:*:*:*:*", "matchCriteriaId": "6D2A01C1-D56C-4198-8ADB-11739F791E2B", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:log4j:3.0.0:alpha1_rc2:*:*:*:*:*:*", "matchCriteriaId": "D6F8BD61-DD30-4D64-842C-850E5B117036", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:log4j:3.0.0:beta1:*:*:*:*:*:*", "matchCriteriaId": "ED00C38D-27EA-489C-9A2B-3594ACA8A3C5", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:log4j:3.0.0:beta2:*:*:*:*:*:*", "matchCriteriaId": "8794D719-1D90-4378-B48B-698EA40FBFB2", "vulnerable": true}, {"criteria": "cpe:2.3:a:apache:log4j:3.0.0:beta3:*:*:*:*:*:*", "matchCriteriaId": "74C9FCBD-ECAD-4C29-B97A-2B9D97C0FC1F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.\n\nAn attacker can exploit this issue only if both of the following conditions are met:\n\n * The application uses JsonTemplateLayout.\n * The application logs a MapMessage, or logs an object directly (e.g., via Logger.info(Object), which wraps it in an ObjectMessage), where the message contains an attacker-controlled floating-point value.\n\n\nUsers are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue.\n\nNote: The fix released in version 2.25.4 did not cover all affected code paths. CVE-2026-49844 was assigned to the remaining issue, which concerns the MapMessage.asJson() serialization in Apache Log4j API and is fixed in versions 2.25.5 and 2.26.1."}, {"lang": "es", "value": "El JsonTemplateLayout de Apache Log4j https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , en versiones hasta la 2.25.3 inclusive, produce una salida JSON no v\u00e1lida cuando los eventos de registro contienen valores de punto flotante no finitos (NaN, Infinity o -Infinity), los cuales est\u00e1n prohibidos por el RFC 8259. Esto puede hacer que los sistemas de procesamiento de registros posteriores rechacen o no puedan indexar los registros afectados.\n\nUn atacante puede explotar este problema solo si se cumplen las dos condiciones siguientes:\n\n * La aplicaci\u00f3n utiliza JsonTemplateLayout.\n * La aplicaci\u00f3n registra un MapMessage que contiene un valor de punto flotante controlado por el atacante.\n\nSe aconseja a los usuarios actualizar a Apache Log4j JSON Template Layout 2.25.4, que corrige este problema."}], "id": "CVE-2026-34481", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security@apache.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34481", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-10T17:41:23.224802Z", "version": "2.0.3"}}]}, "published": "2026-04-10T16:16:31.663", "references": [{"source": "security@apache.org", "tags": ["Issue Tracking"], "url": "https://github.com/apache/logging-log4j2/pull/4080"}, {"source": "security@apache.org", "tags": ["Mailing List", "Vendor Advisory"], "url": "https://lists.apache.org/thread/n34zdv00gbkdbzt2rx9rf5mqz6lhopcv"}, {"source": "security@apache.org", "tags": ["Product"], "url": "https://logging.apache.org/cyclonedx/vdr.xml"}, {"source": "security@apache.org", "tags": ["Technical Description"], "url": "https://logging.apache.org/log4j/2.x/manual/json-template-layout.html"}, {"source": "security@apache.org", "tags": ["Vendor Advisory"], "url": "https://logging.apache.org/security.html#CVE-2026-34481"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2026/04/10/10"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-116"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output", "id": "2457321", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457321"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-241", "details": ["A flaw was found in Apache Log4j's JsonTemplateLayout. This vulnerability allows a remote attacker to disrupt log processing systems. By sending log events that include specific non-numeric floating-point values, the attacker can cause the JsonTemplateLayout to generate invalid JSON output. This invalid output can then lead to downstream systems rejecting or failing to index these logs, effectively causing a denial of service for log analysis."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-34481", "package_state": [{"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Fix deferred", "package_name": "log4j-layout-template-json", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "log4j-layout-template-json", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:jboss_data_grid:8", "fix_state": "Fix deferred", "package_name": "log4j-layout-template-json", "product_name": "Red Hat Data Grid 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "log4j:2/log4j", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "log4j", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7", "fix_state": "Fix deferred", "package_name": "log4j-layout-template-json", "product_name": "Red Hat JBoss Enterprise Application Platform 7"}, {"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:8", "fix_state": "Fix deferred", "package_name": "log4j-layout-template-json", "product_name": "Red Hat JBoss Enterprise Application Platform 8"}, {"cpe": "cpe:/a:redhat:jbosseapxp", "fix_state": "Fix deferred", "package_name": "log4j-layout-template-json", "product_name": "Red Hat JBoss Enterprise Application Platform Expansion Pack"}, {"cpe": "cpe:/a:redhat:offline_knowledge_portal:1", "fix_state": "Fix deferred", "package_name": "redhat-user-workloads/rhokp-core-encrypted", "product_name": "Red Hat Offline Knowledge Portal"}, {"cpe": "cpe:/a:redhat:amq_streams:3", "fix_state": "Fix deferred", "package_name": "log4j-layout-template-json", "product_name": "streams for Apache Kafka 3"}], "public_date": "2026-04-10T15:43:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-34481\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34481\nhttps://github.com/apache/logging-log4j2/pull/4080\nhttps://lists.apache.org/thread/n34zdv00gbkdbzt2rx9rf5mqz6lhopcv\nhttps://logging.apache.org/cyclonedx/vdr.xml\nhttps://logging.apache.org/log4j/2.x/manual/json-template-layout.html\nhttps://logging.apache.org/security.html#CVE-2026-34481"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.14.0,2.25.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[3.0.0-alpha1,3.0.0-beta3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Apache Log4j JSON Template Layout", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "log4j", "vendor": "apache"}], "created": "2026-04-13T12:44:41.113879+00:00", "updated": "2026-07-31T18:00:08.132603+00:00", "vendors": ["apache", "apache$PRODUCT$log4j"]}