Executive brief
Apache Log4j's JSON Template Layout, a component used to format logs into JSON for systems like Elasticsearch, fails to properly handle certain mathematical values like 'Infinity' or 'NaN'. An attacker who can influence the data being logged can cause the system to generate invalid JSON files. This can lead to downstream log processing systems failing to index or rejecting important security and operational logs, potentially creating blind spots in monitoring.
Technical details
A vulnerability in Apache Log4j's JsonTemplateLayout (versions up to 2.25.3) results in the production of invalid JSON when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity). These values are prohibited by RFC 8259 unless quoted as strings. An attacker can exploit this by providing malicious floating-point values to an application that logs them via MapMessage or ObjectMessage using the JsonTemplateLayout. This leads to malformed log records that downstream indexing services (e.g., Elasticsearch) may reject. While version 2.25.4 provided an initial fix, full remediation for all code paths (specifically MapMessage.asJson()) requires upgrading to 2.25.5 or 2.26.1.
Affected products
- Apache Software Foundation Log4j JSON Template Layout up to and including 2.25.3
Timeline
- 2026-03-24: patched: Initial pull request merged for version 2.25.4
- 2026-04-10: disclosed: Public advisory published
References
- https://repo.maven.apache.org/maven2
- https://github.com/apache/logging-log4j2/pull/4080
- https://lists.apache.org/thread/n34zdv00gbkdbzt2rx9rf5mqz6lhopcv
- https://logging.apache.org/cyclonedx/vdr.xml
- https://logging.apache.org/log4j/2.x/manual/json-template-layout.html
- https://logging.apache.org/security.html
- http://www.openwall.com/lists/oss-security/2026/04/10/10