CVE-2026-49844¶
WSO2 Products impacted: no
Customer action required: no
REPORTED VULNERABILITY¶
Improper encoding of non-finite floating point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON. When a MapMessage contains a non-finite IEEE 754 value (NaN, Infinity or -Infinity), MapMessage.asJson() emits the corresponding bare token, which RFC 8259 does not permit. The defect is reachable only when both of the following hold: the application uses the message resolver of JsonTemplateLayout (or another layout that relies on MapMessage.asJson()), and the application logs a MapMessage containing an attacker-controlled floating point value.1
REPORTED PRODUCTS¶
- WSO2 Identity Server : 7.2.0
WSO2 JUSTIFICATION¶
The Log4j API distribution that reaches the runtime in WSO2 Identity Server does contain the pre-fix MapMessage#asJson implementation. However, neither of the two preconditions required by the advisory can hold in the shipped product:
No JSON layout is configured. All appenders in the shipped repository/conf/log4j2.properties use PatternLayout. No JsonTemplateLayout, JsonLayout or event template is configured anywhere under repository/conf.
No MapMessage is ever logged. A review of the shipped distribution found that MapMessage is referenced only within the Log4j and pax-logging libraries themselves. No WSO2 component constructs a MapMessage or serialises one to JSON.
Since the defect only manifests when a MapMessage carrying an attacker-supplied non-finite float is serialised through a JSON-producing layout, and neither condition is met, the defect cannot be triggered. The impact of the defect is limited to malformed log output; it does not affect confidentiality or availability of the product.
Based on this evidence, we conclude that this vulnerability does not pose a security risk to the impacted versions of WSO2 products listed above.