Skip to content
VulniPulse
Sign in
Highest advisory severityHigh 3 vendors · 4 advisories

CVE-2026-34481

CVE-2026-34481: 4 tracked advisory records across Apache, NetApp, Red Hat. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

Apache

2 advisories
  • Advisory severityMedium6.3

    Medium [CVE-2026-34481 +1] Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson

    CVE-2026-49844Source published Source updated

    This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.

    Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document. The defect is reachable only when both of the following conditions hold: - The application uses the message resolver of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}). - The…

    Affected products in this advisory
    • Apache Log4j API
    Source-reported affected versions
    • Apache Log4j API 2.13.1 before 2.25.5
    • Apache Log4j API 2.26.0 before 2.26.1
    • Apache Log4j API 3.0.0-alpha1 through 3.0.0-beta2
    Source-reported fixed versions
    • 2.25.5
    • 2.26.1
    Mitigation guidance
    • Users are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.
    Full advisory and evidenceOpen source bulletin
  • Advisory severityMedium6.3

    Medium [CVE-2026-34481] Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and…

    CVE-2026-34481Source published Source updated

    Apache Log4j's JsonTemplateLayout , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records. An attacker can exploit this issue only if both of the following conditions are met: * The application uses JsonTemplateLayout. * The application logs a MapMessage containing an attacker-controlled floating-point value. Users are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue.

    Affected products in this advisory
    • Apache Log4j
    • Apache Log4j JSON
    • Log4j
    Source-reported affected versions
    • 2.25.3
    Source-reported fixed versions
    • 2.25.4
    Mitigation guidance
    No mitigation guidance extracted; consult the source.
    Full advisory and evidenceOpen source bulletin

NetApp

1 advisory
  • Advisory severityHigh7.5

    High [CVE-2026-34481] Apache Log4j Vulnerability in NetApp Products

    NTAP-20260703-0012Source published Source updated

    Apache Log4j versions 2.14.0 prior to 2.25.4 and 3.0.0-alpha1 through 3.0.0-beta3 are susceptible to a vulnerability which when successfully exploited could lead to addition or modification of data. Successful exploitation of this vulnerability could lead to addition or modification of data. Affected products: Data Infrastructure Insights and Data Secure Storage Workload Security Agent. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.

    Affected products in this advisory
    • Data Infrastructure Insights and Data Secure Storage Workload Security Agent
    Source-reported affected versions
    • 2.14.0
    • 2.25.4
    • 3.0.0
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    • Data Infrastructure Insights and Data Secure Storage Workload Security Agent: Fixed as of 20260804.
    Full advisory and evidenceOpen source bulletin

Red Hat

1 advisory
  • Advisory severityMedium6.5

    Medium [CVE-2026-34481] Denial of Service via invalid JSON output

    CVE-2026-34481Source published

    Denial of Service via invalid JSON output. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-241. Affected package(s): log4j-layout-template-json, offline-knowledge-portal/rhokp-rhel9:1779996999. Resolved in Red Hat advisory RHSA-2026:22619 — update the affected packages (`sudo dnf update`).

    Related products — impact not confirmed
    • log4j-layout-template-json
    • offline-knowledge-portal/rhokp-rhel9:1779996999
    • Red Hat Enterprise Linux
    Source-reported affected versions
    • log4j-layout-template-json
    • offline-knowledge-portal/rhokp-rhel9:1779996999
    Source-reported fixed versions
    • RHSA-2026:22619
    Mitigation guidance
    • Update the affected package(s) to the fixed version shipped in RHSA-2026:22619 (`sudo dnf update` / `yum update`).
    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Turn CVE research into alerts on your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features