CVE-2026-49844
MediumAdvisory
Published 11 Jul 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 6.3
- base score, highest
- EPSS
- 0.008
- 55th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 600
- of 17,787 indexed, latest versions
- Container images
- 566
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization
Carried by container images the latest versions of 600 of 17,787 indexed charts deploy, on 566 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| log4j-apimaven | 2.13.2, 2.13.3, 2.14.0, 2.14.1+24 more | 2.25.5, 2.26.1 | 566 |
- OSV records
- GHSA-qv9r-c865-cp47
Charts affected
600 by stars
| Chart | Latest | Affected images | Radar Score |
|---|
Container images carrying it
566 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| folioci/ | c959b2d6142f | log4j-api | 2.25.5 | 1 |
| folioci/ | d88a675dddf0 | log4j-api | 2.25.5 | 1 |
| folioci/ | 571fa1ffe8c9 | log4j-api | 2.25.5 | 1 |
| folioci/ | f53c327a48e8 | log4j-api | 2.25.5 | 1 |
| folioci/ | 6e8beeb70272 | log4j-api | 2.25.5 | 1 |
| folioci/ | d105c585da30 | log4j-api | 2.25.5 | 1 |
| folioci/ | 1807734472bd | log4j-api | 2.25.5 | 1 |
| folioci/ | 6f60033321b0 | log4j-api | 2.26.1 | 1 |
| folioci/ | 4e2d96c9340d | log4j-api | 2.25.5 | 1 |
| fonoster/ | d08a8a574a50 | log4j-api | 2.25.5 | 1 |
| fonoster/ | e0c823506eb2 | log4j-api | 2.25.5 | 1 |
| franrobles8/ | 99985392d63c | log4j-api | 2.25.5 | 1 |
| gdrocha/ | d5ae64e83d4c | log4j-api | 2.25.5 | 1 |
| geonetwork/ | 20c9bb761f67 | log4j-api | 2.25.5 | 1 |
| geonode/ | 81b1d431b7e9 | log4j-api | 2.25.5 | 1 |
| geoservercloud/ | ca58b74529cd | log4j-api | 2.25.5 | 1 |
| geoservercloud/ | de0b20bd2a43 | log4j-api | 2.26.1 | 1 |
| geoservercloud/ | b04ed89b5d2b | log4j-api | 2.26.1 | 1 |
| geoservercloud/ | 318254b52f96 | log4j-api | 2.26.1 | 1 |
| geoservercloud/ | 5dc0c93a1710 | log4j-api | 2.25.5 | 1 |
| geoservercloud/ | 47ae1bdb4bcc | log4j-api | 2.25.5 | 1 |
| geoservercloud/ | 4f077124f591 | log4j-api | 2.26.1 | 1 |
| geoservercloud/ | 28c3e5a8c5a3 | log4j-api | 2.25.5 | 1 |
| geoservercloud/ | 4f91e3048ac8 | log4j-api | 2.26.1 | 1 |
| geoservercloud/ | 299f0d6232d1 | log4j-api | 2.26.1 | 1 |
| geoservercloud/ | 8c70ee06d5ab | log4j-api | 2.25.5 | 1 |
| geoservercloud/ | 42775ba6a4da | log4j-api | 2.25.5 | 1 |
| geoservercloud/ | 5164f687ce4d | log4j-api | 2.26.1 | 1 |
| glarad/ | 7b02b9e7f1ef | log4j-api | 2.25.5 | 1 |
| glasskube/ | be5133100d63 | log4j-api | 2.25.5 | 1 |
| golenski/ | c863dcb0c513 | log4j-api | 2.25.5 | 1 |
| golenski/ | 3a2b36df247b | log4j-api | 2.25.5 | 1 |
| golenski/ | 954caf4aaf6a | log4j-api | 2.25.5 | 1 |
| gotson/ | 9b15ea6bfc30 | log4j-api | 2.25.5 | 1 |
| gotson/ | ba892ab3e082 | log4j-api | 2.25.5 | 1 |
| graviteeio/ | 4140932887e0 | log4j-api | 2.25.5 | 1 |
| graylog/ | 19de1aff48c2 | log4j-api | 2.25.5 | 1 |
| graylog/ | 598bd41fefd5 | log4j-api | 2.26.1 | 1 |
| graylog/ | 8a1f641cd7aa | log4j-api | 2.26.1 | 1 |
| gresearchdev/ | 91863a50afb7 | log4j-api | 2.25.5 | 1 |
| gresearchdev/ | 8dad36a05ebf | log4j-api | 2.25.5 | 1 |
| gridgain/ | 5ab838d7d3cb | log4j-api | 2.25.5 | 1 |
| gridgain/ | d32d182a0e6a | log4j-api | 2.25.5 | 1 |
| gurolakman/ | 9abb3882bcbd | log4j-api | 2.25.5 | 1 |
| gurolakman/ | 6537e8ed8de8 | log4j-api | 2.25.5 | 1 |
| gurolakman/ | ce23b20a8a17 | log4j-api | 2.25.5 | 1 |
| gurolakman/ | b22e746edd5d | log4j-api | 2.25.5 | 1 |
| gurolakman/ | bf18525c5ad9 | log4j-api | 2.25.5 | 1 |
| gurolakman/ | 8739565c3ea2 | log4j-api | 2.25.5 | 1 |
| hazelcast/ | 8fe26efde8e1 | log4j-api | 2.25.5 | 1 |