Invalid JSON Output Vulnerability in Apache Log4j2 - CVE-2026-34481
Summary
DEBIAN-CVE-2026-34481: Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-p... Affects apache-log4j2 versions 2.13.3-1 – 2.19.0-2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Log4j2 is a widely used logging library for Java applications, enabling developers to log application behavior and errors efficiently. It supports various logging formats and layouts, including JSON, which is favored for its structured data representation. However, versions up to and including 2.25.3 of Log4j2 contain a vulnerability in the JsonTemplateLayout that can produce invalid JSON output when logging non-finite floating-point values, such as NaN, Infinity, or -Infinity.
Vulnerability Detail
The vulnerability arises from Apache Log4j's JsonTemplateLayout, which fails to comply with RFC 8259 by generating invalid JSON when log events include non-finite floating-point values. This can lead to downstream log processing systems rejecting or failing to index the affected records. An attacker can exploit this vulnerability if the application uses JsonTemplateLayout and logs a MapMessage with a floating-point value controlled by the attacker.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid logging non-finite floating-point values in MapMessages when using JsonTemplateLayout. Ensure that any floating-point values are validated before logging to prevent invalid JSON output.
Conclusion
The vulnerability CVE-2026-34481 in Apache Log4j2 poses a risk by generating invalid JSON output, which can disrupt log processing systems. Users are encouraged to upgrade to version 2.25.4 or later to mitigate this issue and ensure compliance with JSON standards.
See every vulnerability recorded for apache-log4j2 →
FAQ
CVE-2026-34481 is a vulnerability in Apache Log4j2 that causes invalid JSON output when logging non-finite floating-point values.
Versions up to and including 2.25.3 of Apache Log4j2 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Non-finite floating-point values include NaN (Not a Number), Infinity, and -Infinity, which are not valid according to JSON standards.
If immediate upgrading is not possible, implement a workaround by ensuring that no non-finite floating-point values are logged in your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-log4j2.
