https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 15:45:00 +0000 https://vulnerability.circl.lu/vuln/ghsa-w35j-pv5h-q9q9 <p><strong>Affected:</strong> Maven: org.apache.logging.log4j:log4j-layout-template-json</p> <p>Apache Log4j&#39;s [`JsonTemplateLayout`](https://logging.apache.org/log4j/2.x/manual/json-template-layout.html), in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (`NaN`, `Infinity`, or `-Infinity`), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.</p> <p>An attacker can exploit this issue only if both of the following conditions are met:</p> <p>* The application uses `JsonTemplateLayout`. * The application logs a `MapMessage` containing an attacker-controlled floating-point value.</p> <p>Users are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue.</p> <p><strong>Affected:</strong> Maven: org.apache.logging.log4j:log4j-layout-template-json</p> <p>Apache Log4j&#39;s [`JsonTemplateLayout`](https://logging.apache.org/log4j/2.x/manual/json-template-layout.html), in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (`NaN`, `Infinity`, or `-Infinity`), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.</p> <p>An attacker can exploit this issue only if both of the following conditions are met:</p> <p>* The application uses `JsonTemplateLayout`. * The application logs a `MapMessage` containing an attacker-controlled floating-point value.</p> <p>Users are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue.</p> https://vulnerability.circl.lu/vuln/ghsa-w35j-pv5h-q9q9