Apache Log4j JSON Template Layout up to 2.25.3/3.0.0-beta3 JsonTemplateLayout escape output

Summaryinfo

A vulnerability was found in Apache Log4j JSON Template Layout up to 2.25.3/3.0.0-beta3. It has been rated as problematic. Affected is an unknown function of the component JsonTemplateLayout. This manipulation causes escape output. The identification of this vulnerability is CVE-2026-34481. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Apache Log4j JSON Template Layout up to 2.25.3/3.0.0-beta3. It has been declared as problematic. Affected by this vulnerability is an unknown function of the component JsonTemplateLayout. The manipulation with an unknown input leads to a escape output vulnerability. The CWE definition for the vulnerability is CWE-116. The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. As an impact it is known to affect integrity. The summary by CVE is:

Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records. An attacker can exploit this issue only if both of the following conditions are met: * The application uses JsonTemplateLayout. * The application logs a MapMessage, or logs an object directly (e.g., via Logger.info(Object), which wraps it in an ObjectMessage), where the message contains an attacker-controlled floating-point value. Users are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue. Note: The fix released in version 2.25.4 did not cover all affected code paths. CVE-2026-49844 was assigned to the remaining issue, which concerns the MapMessage.asJson() serialization in Apache Log4j API and is fixed in versions 2.25.5 and 2.26.1.

The weakness was shared by Ap4Sh. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-34481 since 03/28/2026. The exploitation appears to be difficult. The attack can be launched remotely. The exploitation doesn't need any form of authentication. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/11/2026).

The vulnerability scanner Nessus provides a plugin with the ID 306041 (Linux Distros Unpatched Vulnerability : CVE-2026-34481), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 2.25.4 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (306041) and CERT Bund (WID-SEC-2026-1067). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Google Cloud Platform
• Red Hat Enterprise Linux
• SUSE Linux
• IBM SPSS
• SUSE openSUSE
• IBM Tivoli Network Manager
• IBM DB2
• Microsoft Azure Linux
• Apache log4j
• IBM App Connect Enterprise
• IBM Tivoli Netcool/OMNIbus
• Splunk Splunk Enterprise
• IBM License Metric Tool

Productinfo

Vendor

• Apache

Name

• Log4j JSON Template Layout

Version

• 2.25.0
• 2.25.1
• 2.25.2
• 2.25.3
• 3.0.0-beta1
• 3.0.0-beta2
• 3.0.0-beta3

License

• open-source

Website

• Vendor: https://www.apache.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion