{"id":"CVE-2026-45104","aliases":["DEBIAN-CVE-2026-45104","EUVD-2026-32631","GHSA-4h8g-378q-r75m","UBUNTU-CVE-2026-45104","openSUSE-SU-2026:20857-1"],"status":"published","title":"MapServer: NULL pointer dereference in SLD `\u003cElseFilter\u003e` rule parsing reachable via WMS `SLD_BODY`","description":"MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls _SLDApplyRuleValues(psRule, psLayer, 1); for any \u003cRule\u003e carrying \u003cElseFilter/\u003e — it assumes msSLDParseRule added one class. When the rule has no symbolizer (a structurally valid SLD), msSLDParseRule adds zero, and _SLDApplyRuleValues ends up indexing _class[-1], resulting in a NULL pointer dereference. A 200-byte well-formed SLD via the WMS SLD_BODY= parameter is enough to trigger this, no auth required. This vulnerability is fixed in 8.6.3.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.0032,"percentile":0.25275,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-129","CWE-476"],"published":"2026-05-27T18:41:39Z","modified":"2026-10-28T02:30:50Z","fixes":[{"ecosystem":"Debian:14","package":"mapserver","fixed_in":["8.6.3-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0.0-3","8.0.0-3+deb12u1","8.0.1-1","8.0.1-1~exp1","8.0.1-2","8.0.1-2.1~exp1","8.0.1-2~bpo12+1","8.0.1-3","8.0.1-3~exp1","8.0.1-4","8.0.1-5","8.0.2-1","8.0.2-1~bpo12+1","8.2.0-1","8.2.0-1~bpo12+1","8.2.0~beta1-1~exp1","8.2.0~beta2-1~exp1","8.2.0~beta3-1~exp1","8.2.0~rc1-1~exp1","8.2.0~rc2-1~exp1","8.2.0~rc3-1~exp1","8.2.1-1","8.2.1-1~bpo12+1","8.2.2-1","8.2.2-1~bpo12+1","8.4.0-1","8.4.0-1~bpo12+1","8.4.0-2","8.4.0-3","8.4.0-4","8.4.0~beta1-1~exp1","8.4.0~beta2-1~exp1","8.4.0~rc1-1~exp1","8.4.1-1","8.4.1-1~bpo13+1","8.4.1-2","8.6.0-1","8.6.0-1~bpo13+1","8.6.0~beta1-1~exp1","8.6.0~beta2-1~exp1","8.6.0~rc1-1~exp1","8.6.1-1","8.6.1-1~bpo13+1","8.6.2-1","8.6.2-1~bpo13+1","8.6.3-1","8.6.3-1~bpo13+1","8.6.4-1","8.6.4-1~bpo13+1","8.6.5-1","8.6.5-1~bpo13+1","8.6.6-1","8.6.6-1~bpo13+1"]},{"source":"osv","ecosystem":"Debian:13","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.0-4","8.4.0-4+deb13u1","8.4.0-4+deb13u2","8.4.1-1","8.4.1-1~bpo13+1","8.4.1-2","8.6.0-1","8.6.0-1~bpo13+1","8.6.0~beta1-1~exp1","8.6.0~beta2-1~exp1","8.6.0~rc1-1~exp1","8.6.1-1","8.6.1-1~bpo13+1","8.6.2-1","8.6.2-1~bpo13+1","8.6.3-1","8.6.3-1~bpo13+1","8.6.4-1","8.6.4-1~bpo13+1","8.6.5-1","8.6.5-1~bpo13+1","8.6.6-1","8.6.6-1~bpo13+1"]},{"source":"osv","ecosystem":"Debian:14","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.6.3-1"}]}],"versions":["8.4.0-4","8.4.1-1","8.4.1-1~bpo13+1","8.4.1-2","8.6.0-1","8.6.0-1~bpo13+1","8.6.0~beta1-1~exp1","8.6.0~beta2-1~exp1","8.6.0~rc1-1~exp1","8.6.1-1","8.6.1-1~bpo13+1","8.6.2-1","8.6.2-1~bpo13+1","8.6.3-1~bpo13+1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.0-4build1","7.0.0-5ubuntu1","7.0.0-7","7.0.0-8","7.0.0-8build1","7.0.0-9","7.0.0-9ubuntu1","7.0.0-9ubuntu2","7.0.0-9ubuntu3","7.0.0-9ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.0.6-2build1","7.0.7-1","7.0.7-1build1","7.0.7-1build2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.4.1-1build1","7.4.1-1build3","7.4.2-1","7.4.2-1build1","7.4.3-1","7.4.3-1build2","7.4.3-2","7.4.3-2build1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.6.3-1~exp1ubuntu1","7.6.4-2","7.6.4-2build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.0.1-2build1","8.0.1-2build2","8.0.1-2build3","8.0.1-2build5","8.0.1-4ubuntu1","8.0.1-4ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.0-1build1","8.4.0-4","8.4.0-4build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.6.0-1build1","8.6.4-1","8.6.5-1","8.6.5-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mapserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.0-4build1","8.4.1-1","8.4.1-1build1","8.4.1-2","8.4.1-2build1","8.6.0-1","8.6.0-1build1"]}],"products":[{"vendor":"mapserver","product":"mapserver"},{"vendor":"osgeo","product":"mapserver"}],"references":[{"url":"https://github.com/MapServer/MapServer/security/advisories/GHSA-4h8g-378q-r75m","tags":["x_refsource_CONFIRM","Exploit","Mitigation","Vendor Advisory","advisory","report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45104.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45104","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-45104","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-45104","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-45104","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1260869","tags":["report"]},{"url":"https://bugzilla.suse.com/1266663","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-33721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45104","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-45104","title":"MapServer: NULL pointer dereference in SLD `\u003cElseFilter\u003e` rule parsing reachable via WMS `SLD_BODY`","description":"MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls _SLDApplyRuleValues(psRule, psLayer, 1); for any \u003cRule\u003e carrying \u003cElseFilter/\u003e — it assumes msSLDParseRule added one class. When the rule has no symbolizer (a structurally valid SLD), msSLDParseRule adds zero, and _SLDApplyRuleValues ends up indexing _class[-1], resulting in a NULL pointer dereference. A 200-byte well-formed SLD via the WMS SLD_BODY= parameter is enough to trigger this, no auth required. This vulnerability is fixed in 8.6.3.","status":"published","published":"2026-05-27T18:41:39.396Z","modified":"2026-06-01T17:08:18.608Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-129","CWE-476"],"updated_at":"2026-11-02T13:46:32.755125Z"}],"euvd":[{"id":"EUVD-2026-32631","description":"MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls _SLDApplyRuleValues(psRule, psLayer, 1); for any \u003cRule\u003e carrying \u003cElseFilter/\u003e — it assumes msSLDParseRule added one class. When the rule has no symbolizer (a structurally valid SLD), msSLDParseRule adds zero, and _SLDApplyRuleValues ends up indexing _class[-1], resulting in a NULL pointer dereference. A 200-byte well-formed SLD via the WMS SLD_BODY= parameter is enough to trigger this, no auth required. This vulnerability is fixed in 8.6.3.","status":"published","published":"2026-05-27T18:41:39Z","modified":"2026-06-01T17:08:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:57.828765Z"}],"nvd":[{"id":"CVE-2026-45104","description":"MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls _SLDApplyRuleValues(psRule, psLayer, 1); for any \u003cRule\u003e carrying \u003cElseFilter/\u003e — it assumes msSLDParseRule added one class. When the rule has no symbolizer (a structurally valid SLD), msSLDParseRule adds zero, and _SLDApplyRuleValues ends up indexing _class[-1], resulting in a NULL pointer dereference. A 200-byte well-formed SLD via the WMS SLD_BODY= parameter is enough to trigger this, no auth required. This vulnerability is fixed in 8.6.3.","status":"published","published":"2026-05-27T20:16:38.407Z","modified":"2026-06-17T10:51:41.237Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-129","CWE-476"],"updated_at":"2026-11-02T14:12:20.885865Z"}],"osv":[{"id":"CVE-2026-45104","title":"MapServer: NULL pointer dereference in SLD `\u003cElseFilter\u003e` rule parsing reachable via WMS `SLD_BODY`","description":"MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls _SLDApplyRuleValues(psRule, psLayer, 1); for any \u003cRule\u003e carrying \u003cElseFilter/\u003e — it assumes msSLDParseRule added one class. When the rule has no symbolizer (a structurally valid SLD), msSLDParseRule adds zero, and _SLDApplyRuleValues ends up indexing _class[-1], resulting in a NULL pointer dereference. A 200-byte well-formed SLD via the WMS SLD_BODY= parameter is enough to trigger this, no auth required. This vulnerability is fixed in 8.6.3.","status":"published","published":"2026-05-27T18:41:39.396Z","modified":"2026-10-28T02:30:50.174084362Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-129","CWE-476"],"updated_at":"2026-11-02T15:45:05.172514Z"},{"id":"DEBIAN-CVE-2026-45104","description":"MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls _SLDApplyRuleValues(psRule, psLayer, 1); for any \u003cRule\u003e carrying \u003cElseFilter/\u003e — it assumes msSLDParseRule added one class. When the rule has no symbolizer (a structurally valid SLD), msSLDParseRule adds zero, and _SLDApplyRuleValues ends up indexing _class[-1], resulting in a NULL pointer dereference. A 200-byte well-formed SLD via the WMS SLD_BODY= parameter is enough to trigger this, no auth required. This vulnerability is fixed in 8.6.3.","status":"published","published":"2026-05-27T20:16:38.407Z","modified":"2026-10-01T03:03:23.680511209Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"UBUNTU-CVE-2026-45104","description":"MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls _SLDApplyRuleValues(psRule, psLayer, 1); for any \u003cRule\u003e carrying \u003cElseFilter/\u003e — it assumes msSLDParseRule added one class. When the rule has no symbolizer (a structurally valid SLD), msSLDParseRule adds zero, and _SLDApplyRuleValues ends up indexing _class[-1], resulting in a NULL pointer dereference. A 200-byte well-formed SLD via the WMS SLD_BODY= parameter is enough to trigger this, no auth required. This vulnerability is fixed in 8.6.3.","status":"published","published":"2026-05-27T20:16:00Z","modified":"2026-10-17T13:00:10.218880988Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:26.396868Z"},{"id":"openSUSE-SU-2026:20857-1","title":"Security update for mapserver","description":"This update for mapserver fixes the following issues:\n\nChanges in mapserver:\n\n- Update to releasee 8.6.3\n  * SLD parser: fix out of bounds access on SLD with only a Rule\n    with a ElseFilter but without a symbolizer\n    [CVE-2026-33721, boo#1260869] [CVE-2026-45104, boo#1266663]\n","status":"published","published":"2026-06-01T16:05:47Z","modified":"2026-06-03T08:30:27.382749496Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}