CVE-2026-34481
1 advisory.
Maven/org.apache.logging.log4j:log4j-layout-template-json CVE-2026-34481: medium
Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout
Action: Upgrade org.apache.logging.log4j:log4j-layout-template-json to 2.25.4 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.14.0 | 2.25.4 | - |
| 3.0.0-alpha1 | - | 3.0.0-beta3 |
Fixed versions
| 2.25.4 |
Sources
- osv: GHSA-w35j-pv5h-q9q9
- https://nvd.nist.gov/vuln/detail/CVE-2026-34481
- https://github.com/apache/logging-log4j2/pull/4080
- https://github.com/apache/logging-log4j2
- https://lists.apache.org/thread/n34zdv00gbkdbzt2rx9rf5mqz6lhopcv
- https://logging.apache.org/cyclonedx/vdr.xml
- https://logging.apache.org/log4j/2.x/manual/json-template-layout.html
- https://logging.apache.org/security.html#CVE-2026-34481
- http://www.openwall.com/lists/oss-security/2026/04/10/10
CVE-2026-34481 · published · modified · JSON