Osgeo vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Osgeo flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2025-58360 OSGeo GeoServer Improper Restriction of XML External Entity ReferenceExploited since Dec 11, 2025 · CVSS 8.2
• CVE-2024-36401 OSGeo GeoServer GeoTools Eval InjectionExploited since Jul 15, 2024 · CVSS 9.8
• CVE-2022-24816 OSGeo GeoServer JAI-EXT Code InjectionExploited since Jun 26, 2024 · CVSS 10

Latest high and critical flaws

• CVE-2026-4738 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules).Critical 9.4 · Mar 24, 2026
• CVE-2025-58360 OSGeo GeoServer Improper Restriction of XML External Entity ReferenceExploited · High 8.2 · Nov 25, 2025
• CVE-2024-36401 OSGeo GeoServer GeoTools Eval InjectionExploited · Critical 9.8 · Jul 1, 2024
• CVE-2022-0699 A double-free condition exists in contrib/shpsort.c of shapelib 1.5.0 and older releases.Critical 9.8 · Oct 17, 2022
• CVE-2021-28398 A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the directory harvester before-script to execute arbitrary OS commands remotely oHigh 7.2 · Sep 5, 2022
• CVE-2021-40822 GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host.High 7.5 · May 1, 2022
• CVE-2022-24816 OSGeo GeoServer JAI-EXT Code InjectionExploited · Critical 10 · Apr 13, 2022
• CVE-2021-39371 An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the enHigh 7.5 · Aug 22, 2021
• CVE-2019-25050 netCDF in GDAL 2.4.2 through 3.0.4 has a stack-based buffer overflow in nc4_get_att (called from nc4_get_att_tc and nc_get_att_text) and in uffd_cleanup (calledHigh 7.8 · Jul 20, 2021
• CVE-2010-1678 Mapserver 5.2, 5.4 and 5.6 before 5.6.5-2 improperly validates symbol index values during Mapfile parsing.High 7.5 · Oct 29, 2019
• CVE-2019-17545 GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded.Critical 9.8 · Oct 13, 2019
• CVE-2016-9839 In MapServer before 7.0.3, OGR driver error messages are too verbose and may leak sensitive information if data connection fails.High 7.5 · Dec 8, 2016
• CVE-2011-2704 Stack-based buffer overflow in MapServer before 4.10.7 and 5.x before 5.6.7 allows remote attackers to execute arbitrary code via vectors related to OGC filter High 7.5 · Aug 1, 2011
• CVE-2011-2703 Multiple SQL injection vulnerabilities in MapServer before 4.10.7, 5.x before 5.6.7, and 6.x before 6.0.1 allow remote attackers to execute arbitrary SQL commanHigh 7.5 · Aug 1, 2011
• CVE-2010-2540 mapserv.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 does not properly restrict the use of CGI command-line arguments that were intended for debHigh 10 · Aug 2, 2010
• CVE-2009-2281 Multiple heap-based buffer underflows in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x through 4.10.4 and 5.x before 5.4.2 allow remote attHigh 10 · Oct 23, 2009
• CVE-2009-1177 Multiple stack-based buffer overflows in maptemplate.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 have unknown impact and remote attack vectHigh 10 · Mar 31, 2009
• CVE-2009-1176 mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does not ensure that the string holding the id parameter ends in a '\0' character, whicHigh 10 · Mar 31, 2009
• CVE-2009-0843 The msLoadQuery function in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to determine the existence of arbitrary files viHigh 7.8 · Mar 31, 2009
• CVE-2009-0841 Directory traversal vulnerability in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when running on Windows with Cygwin, allows remotHigh 10 · Mar 31, 2009
• CVE-2009-0840 Heap-based buffer underflow in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 allows remote attackers to High 10 · Mar 31, 2009
• CVE-2009-0839 Stack-based buffer overflow in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when the server has a map with a long IMAGEPATH or NAMEHigh 10 · Mar 31, 2009