org.apache.logging.log4j:log4j-api vulnerabilities

CVEs whose affected-version data names the org.apache.logging.log4j:log4j-api package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-49844Medium· 6.3PoC

2mo ago

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. This issue affects Apache Log4j API versions 2.13.1 through 2.25.4 and version 2.26.0.…

▾ TwilightApache Software Foundation · org.apache.logging.log4j:log4j-apiEPSS 0.81%via NVD