Skip to content

CVE-2026-49844

WSO2 Products impacted: no

Customer action required: no


REPORTED VULNERABILITY

Improper encoding of non-finite floating point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. When a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity or -Infinity), MapMessage.asJson() emits the corresponding bare token, which RFC 8259 does not permit. The defect is reachable only when both of the following hold: the application uses the message resolver of JsonTemplateLayout (or another layout that relies on MapMessage.asJson()), and the application logs a MapMessage containing an attacker-controlled floating point value.1

REPORTED PRODUCTS

  • WSO2 Identity Server : 7.2.0

WSO2 JUSTIFICATION

The Log4j API distribution that reaches the runtime in WSO2 Identity Server does contain the pre-fix MapMessage#asJson implementation. However, neither of the two preconditions required by the advisory can hold in the shipped product:

No JSON layout is configured. All appenders in the shipped repository/conf/log4j2.properties use PatternLayout. No JsonTemplateLayout, JsonLayout or event template is configured anywhere under repository/conf.

No MapMessage is ever logged. A review of the shipped distribution found that MapMessage is referenced only within the Log4j and pax-logging libraries themselves. No WSO2 component constructs a MapMessage or serialises one to JSON.

Since the defect only manifests when a MapMessage carrying an attacker-supplied non-finite float is serialised through a JSON-producing layout, and neither condition is met, the defect cannot be triggered. The impact of the defect is limited to malformed log output; it does not affect confidentiality or availability of the product.

Based on this evidence, we conclude that this vulnerability does not pose a security risk to the impacted versions of WSO2 products listed above.

REFERENCES