CVE-2026-49844
MediumAdvisory
Published 11 Jul 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.3
- base score, highest
- EPSS
- 0.008
- 55th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 600
- of 17,787 indexed, latest versions
- Container images
- 566
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization
Carried by container images the latest versions of 600 of 17,787 indexed charts deploy, on 566 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| log4j-apimaven | 2.13.2, 2.13.3, 2.14.0, 2.14.1+24 more | 2.25.5, 2.26.1 | 566 |
- OSV records
- GHSA-qv9r-c865-cp47
Charts affected
600 by stars
| Chart | Latest | Affected images | Radar Score |
|---|
Container images carrying it
566 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| apache/ | 0cef139b6bf1 | log4j-api | 2.25.5 | 1 |
| apache/ | 80136ae753ee | log4j-api | 2.25.5 | 1 |
| apache/ | 75d48a62748f | log4j-api | 2.25.5 | 1 |
| apache/ | a2bab1be574c | log4j-api | 2.25.5 | 1 |
| apache/ | bff074a5d005 | log4j-api | 2.25.5 | 1 |
| apache/ | 090b7f87ec7f | log4j-api | 2.25.5 | 1 |
| apachepinot/ | 0018bb04ced7 | log4j-api | 2.25.5 | 1 |
| apachepulsar/ | 16f9fdab3fa6 | log4j-api | 2.25.5 | 1 |
| apachepulsar/ | 3b262ab7a7d9 | log4j-api | 2.25.5 | 1 |
| apachepulsar/ | 9c9947de139d | log4j-api | 2.25.5 | 1 |
| apachepulsar/ | d056c89b7131 | log4j-api | 2.25.5 | 1 |
| apachepulsar/ | d538416d5afe | log4j-api | 2.25.5 | 1 |
| apache/ | 76c176e8a0e4 | log4j-api | 2.25.5 | 1 |
| apache/ | c8fb51195444 | log4j-api | 2.25.5 | 1 |
| apache/ | e2be712fc4f4 | log4j-api | 2.25.5 | 1 |
| apache/ | 1bd5756f6273 | log4j-api | 2.25.5 | 1 |
| apache/ | 133d35d2c263 | log4j-api | 2.25.5 | 1 |
| apache/ | b4ec8c18d079 | log4j-api | 2.25.5 | 1 |
| apache/ | 80530f0308a5 | log4j-api | 2.25.5 | 1 |
| apache/ | 90b7fa1dc018 | log4j-api | 2.26.1 | 1 |
| apache/ | 92d055a84e9e | log4j-api | 2.25.5 | 1 |
| apache/ | ffab324253ed | log4j-api | 2.25.5 | 1 |
| apimap/ | ae2b3ab00177 | log4j-api | 2.25.5 | 1 |
| aroralalit/ | 2a094f597b36 | log4j-api | 2.25.5 | 1 |
| arturisimo/ | fff9de644941 | log4j-api | 2.25.5 | 1 |
| arturisimo/ | c95524e90b57 | log4j-api | 2.25.5 | 1 |
| assistiot/ | 23f195a7a26a | log4j-api | 2.25.5 | 1 |
| assistiot/ | ae8b3d72eb5d | log4j-api | 2.25.5 | 1 |
| assistiot/ | 0df4b4fa899a | log4j-api | 2.25.5 | 1 |
| assistiot/ | e4414cb72dc4 | log4j-api | 2.25.5 | 1 |
| atlassian/ | 4af4bb6c8d46 | log4j-api | 2.26.1 | 1 |
| atlassian/ | 05933f2b1cfd | log4j-api | 2.25.5 | 1 |
| atlassian/ | c81cc7d6bc9e | log4j-api | 2.26.1 | 1 |
| atlassian/ | ebf761c7d437 | log4j-api | 2.25.5 | 1 |
| atlassian/ | 64a75aa4ec4e | log4j-api | 2.25.5 | 1 |
| atlassian/ | e5548cd4eea8 | log4j-api | 2.26.1 | 1 |
| audig/ | 2c3fe34ee430 | log4j-api | 2.25.5 | 1 |
| beastob/ | 99a49885ab33 | log4j-api | 2.25.5 | 1 |
| berkeleyskypilot/ | 3bc8bf8f4d83 | log4j-api | 2.25.5 | 1 |
| berkeleyskypilot/ | 8da2f3cda472 | log4j-api | 2.25.5 | 1 |
| binhex/ | fb8952921ab6 | log4j-api | 2.25.5 | 1 |
| bitnamilegacy/ | 15d4647fd491 | log4j-api | 2.25.5 | 1 |
| bitnamilegacy/ | 9cfd2df1294d | log4j-api | 2.25.5 | 1 |
| bitnamilegacy/ | e6f6ddcce2f1 | log4j-api | 2.25.5 | 1 |
| bitnamilegacy/ | d8440eb6b290 | log4j-api | 2.25.5 | 1 |
| blackducksoftware/ | 90cca32de2cc | log4j-api | 2.25.5 | 1 |
| bluerange/ | 07c8f73b55df | log4j-api | 2.25.5 | 1 |
| camunda/ | ab5abc09e407 | log4j-api | 2.25.5 | 1 |
| castlemock/ | b7f3f1527ba9 | log4j-api | 2.25.5 | 1 |
| cbioportal/ | 08debbd2dbf9 | log4j-api | 2.25.5 | 1 |