[
https://issues.apache.org/jira/browse/KAFKA-20957?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Mickael Maison resolved KAFKA-20957.
------------------------------------
Resolution: Duplicate
> [CVE-2026-49844] [log4j-api] [2.25.4]
> -------------------------------------
>
> Key: KAFKA-20957
> URL: https://issues.apache.org/jira/browse/KAFKA-20957
> Project: Kafka
> Issue Type: Bug
> Reporter: Krishna Chidrawar
> Priority: Major
>
> *Description :* Improper encoding of non-finite floating-point values during
> MapMessage JSON serialization in Apache Log4j API produces output that is not
> valid JSON. This issue affects Apache Log4j API versions 2.13.1 through
> 2.25.4 and version 2.26.0.
> The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage
> contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity),
> MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not
> permit these tokens, so a conformant parser rejects the resulting document.
> The defect is reachable only when both of the following conditions hold:
> * The application uses the message resolver
> [https://logging.apache.org/log4j/2.x/manual/json-template-layout.html#event-template-resolver-message]
> of JsonTemplateLayout or any other layout that relies on MapMessage.asJson()
> or MapMessage.getFormattedMessage(new String[] \{"JSON"}
> ).
> * The application logs a MapMessage that contains an attacker-controlled
> floating-point value.
> An attacker who can supply a non-finite value can cause the affected layout
> to emit malformed JSON, which may corrupt the enclosing log record or disrupt
> downstream log ingestion and parsing.
> Users are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of
> which emit RFC 8259-compliant JSON for non-finite values.
> *NVD URL :* [https://nvd.nist.gov/vuln/detail/CVE-2026-49844]
> *Fix Version :* 2.25.5, 2.26.1
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
