CVE-2026-34481 Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout

What is CVE-2026-34481?

CVE-2026-34481 is a medium-severity vulnerability in Apache Log4j JSON Template Layout, published on 10 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.

An attacker can exploit this issue only if both of the following conditions are met:

* The application uses JsonTemplateLayout. * The application logs a MapMessage, or logs an object directly (e.g., via Logger.info(Object), which wraps it in an ObjectMessage), where the message contains an attacker-controlled floating-point value.

Users are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue.

Note: The fix released in version 2.25.4 did not cover all affected code paths. CVE-2026-49844 was assigned to the remaining issue, which concerns the MapMessage.asJson() serialization in Apache Log4j API and is fixed in versions 2.25.5 and 2.26.1.

Weakness: CWE-116

Which versions are affected by CVE-2026-34481?

4 open source packages ship an affected version, including org.apache.logging.log4j:log4j-layout-template-json. It affects 1 product.

Products include Apache Log4j.

How do I fix CVE-2026-34481?

Upgrade org.apache.logging.log4j:log4j-layout-template-json to 2.25.4 or later.

Is CVE-2026-34481 being exploited?

There is no known exploitation of CVE-2026-34481 in the wild and no public exploit code.

Other vulnerabilities in Apache Log4j JSON Template Layout

• CVE-2021-44228 Apache Log4j2 Remote Code Execution Exploited Critical 10.0
• CVE-2021-45046 Apache Log4j2 Deserialization of Untrusted Data Exploited Critical 9.0
• CVE-2022-23305 SQL injection in JDBC Appender in Apache Log4j V1 Critical 9.8
• CVE-2017-5645 Deserialization of Untrusted Data in Log4j Critical 9.8
• CVE-2022-23302 Deserialization of untrusted data in JMSSink in Apache Log4j 1.x High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-CS40307, CLEANSTART-2026-NV45884, CLEANSTART-2026-QA30361, CLEANSTART-2026-RV51042, CLEANSTART-2026-SX30440, CLSA-2026-1784769579 and 27 more.