CVE-2026-49844
CVE-2026-49844: 4 tracked advisory records across Apache, NetApp, Red Hat. Compare vendor sources and published fix guidance.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Apache
1 advisory- Advisory severityMedium6.3
Medium [CVE-2026-34481 +1] Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson
CVE-2026-49844Source published Source updated
This bulletin covers 2 CVEs. The products, versions, score and guidance below describe the bulletin; check its source for applicability to this specific CVE.
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0. The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document. The defect is reachable only when both of the following conditions hold: - The application uses the message resolver of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}). - The…
- Affected products in this advisory
- Apache Log4j API
- Source-reported affected versions
- Apache Log4j API 2.13.1 before 2.25.5
- Apache Log4j API 2.26.0 before 2.26.1
- Apache Log4j API 3.0.0-alpha1 through 3.0.0-beta2
- Source-reported fixed versions
- 2.25.5
- 2.26.1
- Mitigation guidance
- Users are advised to upgrade to Apache Log4j API 2.25.5 or 2.26.1, both of which emit RFC 8259-compliant JSON for non-finite values.
NetApp
2 advisories- Advisory severityMedium5.9
Medium [CVE-2026-49844] IBM Db2 Vulnerability in NetApp Products
NTAP-20261014-0011Source published Source updated
IBM Db2 Server versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 on Linux, UNIX, and Windows are susceptible to a vulnerability in Apache Log4j. Successful exploitation of this vulnerability could lead to addition or modification of data. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
- Affected products in this advisory
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- 11.5.0
- 11.5.9
- 12.1.0
- 12.1.5
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
- Advisory severityMedium6.3
Medium [CVE-2026-49844] Apache Log4j Vulnerability in NetApp Products
NTAP-20260724-0012Source published Source updated
Apache Log4j versions 2.13.1 through 2.25.4 and version 2.26.0 are susceptible to a vulnerability which when successfully exploited could lead to addition or modification of data. Successful exploitation of this vulnerability could lead to addition or modification of data. NetApp reports that one or more additional products remain under investigation; review the canonical advisory for current status. NetApp states there is no workaround available at this time.
- Affected products in this advisory
- No product details extracted. Check the source bulletin.
- Source-reported affected versions
- 2.13.1
- 2.25.4
- 2.26.0
- Source-reported fixed versions
- No fixed-version detail extracted. This does not mean no fix exists.
- Mitigation guidance
- No mitigation guidance extracted; consult the source.
Red Hat
1 advisory- Advisory severityMedium5.9
Medium [CVE-2026-49844] Malformed JSON output due to improper encoding of floating-point values
CVE-2026-49844Source published Source updated
Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. The fix for CVE-2026-34481 did not cover all code paths: when a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity, or -Infinity), MapMessage.asJson() emits the corresponding bare token. RFC 8259 does not permit these tokens, so a conformant parser rejects the resulting document. The defect is reachable only when both of the following conditions hold: * The application uses the message resolver of JsonTemplateLayout or any other layout that relies on MapMessage.asJson() or MapMessage.getFormattedMessage(new String[]{"JSON"}). * The application logs a MapMessage that contains an attacker-controlled floating-point value. An…
- Affected products in this advisory
- Cryostat 4
- OpenShift Serverless
- Red Hat AI Inference Server
- Red Hat AMQ Broker 7
20 more entries in the full advisory.
- Source-reported affected versions
- 2.13.1
- 2.25.4
- 2.26.0
- Source-reported fixed versions
- 2.25.5
- 2.26.1
- Mitigation guidance
- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Android app · Google Play
Turn CVE research into alerts on your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.