[jira] [Resolved] (KAFKA-20957) [CVE-2026-49844] [log4j-api] [2.25.4]

["Mickael Maison (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/KAFKA-20957?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Mickael Maison resolved KAFKA-20957.
------------------------------------
    Resolution: Duplicate

> [CVE-2026-49844] [log4j-api] [2.25.4]
> -------------------------------------
>
>                 Key: KAFKA-20957
>                 URL: https://issues.apache.org/jira/browse/KAFKA-20957
>             Project: Kafka
>          Issue Type: Bug
>            Reporter: Krishna Chidrawar
>            Priority: Major
>
> *Description :* Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.
> The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document.
> The defect is reachable only when both of the following conditions hold:
>  * The application uses the message resolver [https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message] of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[] \{"JSON"}
> ).
>  * The application logs a MapMessage that contains an attacker-controlled floating-point value.
> An attacker who can supply a non-finite value can cause the affected layout to emit malformed JSON, which may corrupt the enclosing log record or disrupt downstream log ingestion and parsing.
> Users are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.
> *NVD URL :* [https://nvd.nist.gov/vuln/detail/CVE-2026-49844]
> *Fix Version :* 2.25.5, 2.26.1



--
This message was sent by Atlassian Jira
(v8.20.10#820010)