Vulnerabilities

 1 via 1 paths

Dependencies

 22

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Severity
  • 1
Status
  • 1
  • 0
  • 0

medium severity

Improper Encoding or Escaping of Output

  • Vulnerable module: org.apache.logging.log4j:log4j-api
  • Introduced through: org.springframework.boot:spring-boot-starter-logging@4.1.0

Detailed paths

  • Introduced through: timpeeters/spring-boot-contextual-logging@timpeeters/spring-boot-contextual-logging › org.springframework.boot:spring-boot-starter-logging@4.1.0 › org.apache.logging.log4j:log4j-to-slf4j@2.25.4 › org.apache.logging.log4j:log4j-api@2.25.4

Overview

Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output in the MapMessage.asJson() method, which emits the bare NaN, Infinity, or -Infinity tokens instead of an RFC 8259-compliant representation. An attacker can emit malformed JSON that corrupts the enclosing log record or disrupts downstream log ingestion and parsing by supplying non-finite floating-point values that the application records in a logged MapMessage. Exploitation requires the application to use the message resolver of JsonTemplateLayout, or another layout relying on MapMessage.asJson(), and to log a MapMessage holding attacker-controlled floating-point values.

Note: This is a bypass of the fix for the vulnerability described in CVE-2026-34481.

Remediation

A fix was pushed into the master branch but not yet published.

References

Improper Encoding or Escaping of Output vulnerability report