Improper Encoding or Escaping of Output The advisory has been revoked - it doesn't affect any version of package neo4j-5.26-docker-publish (opens in a new tab)
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-MINIMOSLATEST-NEO4J526DOCKERPUBLISH-16328167
- published1 May 2026
- disclosed10 Apr 2026
Introduced: 10 Apr 2026
CVE-2026-34481 (opens in a new tab)Amendment
The Minimos security team deemed this advisory irrelevant for Minimos:latest.
NVD Description
Note: Versions mentioned in the description apply only to the upstream neo4j-5.26-docker-publish package and not the neo4j-5.26-docker-publish package as distributed by Minimos.
Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinity), which are prohibited by RFC 8259. This may cause downstream log processing systems to reject or fail to index affected records.
An attacker can exploit this issue only if both of the following conditions are met:
- The application uses JsonTemplateLayout.
- The application logs a MapMessage, or logs an object directly (e.g., via Logger.info(Object), which wraps it in an ObjectMessage), where the message contains an attacker-controlled floating-point value.
Users are advised to upgrade to Apache Log4j JSON Template Layout 2.25.4, which corrects this issue.
Note: The fix released in version 2.25.4 did not cover all affected code paths. CVE-2026-49844 was assigned to the remaining issue, which concerns the MapMessage.asJson() serialization in Apache Log4j API and is fixed in versions 2.25.5 and 2.26.1.
References
- https://www.cve.org/CVERecord?id=CVE-2026-34481
- https://github.com/advisories/GHSA-w35j-pv5h-q9q9
- https://osv.dev/vulnerability/MINI-42mw-mr2x-q8mr
- https://osv.dev/vulnerability/CVE-2026-34481
- https://github.com/apache/logging-log4j2/pull/4080
- https://lists.apache.org/thread/n34zdv00gbkdbzt2rx9rf5mqz6lhopcv
- https://logging.apache.org/cyclonedx/vdr.xml
- https://logging.apache.org/log4j/2.x/manual/json-template-layout.html
- https://logging.apache.org/security.html#CVE-2026-34481
- http://www.openwall.com/lists/oss-security/2026/04/10/10