{"action":"Upgrade org.apache.logging.log4j:log4j-api to 2.25.5 (2.25.x) or 2.26.1 (2.26.x) or later.","affected":[{"fixed":"2.25.5","introduced":"2.13.1"},{"fixed":"2.26.1","introduced":"2.26.0"}],"component":"org.apache.logging.log4j:log4j-api","cve_ids":["CVE-2026-49844"],"ecosystem":"Maven","epss":0.00595,"exploited":false,"fixed_versions":["2.25.5","2.26.1"],"ghsa_id":"GHSA-qv9r-c865-cp47","id":"tcs_01M5N9A9DJV7TBZDH2ZP7MK1GW","modified_at":"2026-09-10T03:50:52.972700022Z","published_at":"2026-07-11T00:31:48Z","references":["https://osv.dev/vulnerability/GHSA-qv9r-c865-cp47","https://nvd.nist.gov/vuln/detail/CVE-2026-49844","https://github.com/apache/logging-log4j2/pull/4163","https://github.com/apache/logging-log4j2/commit/19edb23e162d6c728a8c2221a240037d389ed300","https://github.com/apache/logging-log4j2/commit/feadf8eb0b4acb6ddfa4c0ab2bbc6d88b8e12d82","https://github.com/apache/logging-log4j2","https://github.com/apache/logging-log4j2/releases/tag/rel/2.25.5","https://github.com/apache/logging-log4j2/releases/tag/rel/2.26.1","https://logging.apache.org/cyclonedx/vdr.xml","https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message","https://logging.apache.org/security.html#CVE-2026-49844"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-qv9r-c865-cp47","url":"https://osv.dev/vulnerability/GHSA-qv9r-c865-cp47"},{"source":"nvd","source_id":"CVE-2026-49844","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49844"}],"summary":"Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization"}