==================================================
CVE-2026-49844 VARIANT analysis  |  log4j-api: 2.25.4-vulnerable-2.25.x
  (alternate data paths into MapMessageJsonFormatter)
==================================================

--- A. nested java.util.Map value (formatMap -> formatNumber) ---
  [nested-map] value=NaN
    JSON output: {"data":{"v":NaN}}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)
  [nested-map] value=Infinity
    JSON output: {"data":{"v":Infinity}}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)
  [nested-map] value=-Infinity
    JSON output: {"data":{"v":-Infinity}}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)

--- B. java.util.List value (formatList -> formatNumber) ---
  [list] value=NaN
    JSON output: {"items":[NaN]}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)
  [list] value=Infinity
    JSON output: {"items":[Infinity]}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)
  [list] value=-Infinity
    JSON output: {"items":[-Infinity]}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)

--- C. Object[] value (formatObjectArray -> formatNumber) ---
  [object-array] value=NaN
    JSON output: {"arr":[NaN]}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)
  [object-array] value=Infinity
    JSON output: {"arr":[Infinity]}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)
  [object-array] value=-Infinity
    JSON output: {"arr":[-Infinity]}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)

--- D. non-List Collection (Set) value (formatCollection -> formatNumber) ---
  [set-collection] value=NaN
    JSON output: {"set":[NaN]}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)
  [set-collection] value=Infinity
    JSON output: {"set":[Infinity]}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)
  [set-collection] value=-Infinity
    JSON output: {"set":[-Infinity]}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)
  [deque-collection] value=NaN
    JSON output: {"deque":[NaN]}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)

--- E. custom Number subclass (formatNumber else-branch) ---
  [custom-number] value=NaN
    JSON output: {"custom":NaN}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)
  [custom-number] value=Infinity
    JSON output: {"custom":Infinity}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)
  [custom-number] value=-Infinity
    JSON output: {"custom":-Infinity}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)

--- F. BigInteger overflow -> Infinity (formatNumber else-branch) ---
  (sanity) huge.doubleValue() = Infinity  (expect Infinity; isFinite=false)
  [bigint-overflow] value=Infinity
    JSON output: {"huge":Infinity}
    >> BARE non-finite token detected (invalid JSON per RFC 8259)
    >> strict JSON parse FAILED (invalid per RFC 8259)

--- G. StringBuilderFormattable emitting bare NaN (control: always quoted) ---
  [formattable-nan] value=NaN
    JSON output: {"formattable":"NaN"}
    >> non-finite value is QUOTED (valid JSON string)
    >> strict JSON parse OK (valid RFC 8259 JSON)

==================================================
VARIANT SUMMARY (2.25.4-vulnerable-2.25.x)
  total cases tested        : 18
  bare NaN/Infinity tokens  : 17
  quoted NaN/Infinity tokens: 1
  JSON parse failures       : 17
==================================================
VERDICT|2.25.4-vulnerable-2.25.x|VULNERABLE|bare=17|quoted=1|parseFail=17