Skip to contentOsgeo Geoserver vulnerabilities
- osgeo geoserver, geoserver org.geoserver.web:gs-web-app, org.geoserver:gs-main +2 moreGeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity ResolutionCVE-2025-58175Fix available6.5 Medium
- osgeo geoserver, geoserver org.geoserver.web:gs-web-app, org.geoserver.web:gs-web-sec-core +2 moreGeoServer has an arbitrary file write vulnerability in its Master Password Dump PageCVE-2025-52465Fix available7.2 High
- osgeo geoserver, geoserver org.geoserver.extension:gs-db2 +1 moreGeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store ConnectionCVE-2025-27511Fix available7.2 High
- geoserverGeoServer is vulnerable to an Unauthenticated XML External Entities (XXE) attack via WMS GetMap featureCVE-2025-58360In KEVPublic exploitFix availableEPSS 61.2%8.2 High
- geoserver, geotools, osgeo geonetwork +2 moreGeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handlingCVE-2025-30220Fix availableEPSS 43.6%9.9 Critical
- geoserverGeoServer has an Infinite Loop Vulnerability in Jiffle processCVE-2025-30145Fix available7.5 High
- geoserverGeoServer Missing Authorization on REST API IndexCVE-2025-27505Fix available5.3 Medium
- geoserverGeoServer Coverage REST API Allows Server Side Request ForgeryCVE-2024-40625Fix available5.5 Medium
- geoserverGWC Home Page communicate version and revision informationCVE-2024-38524Fix available5.3 Medium
- geoserverGeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)CVE-2024-34711Fix available9.3 Critical
- geoserverGeoServer Vulnerable to Unauthenticated SSRF via TestWfsPostCVE-2024-29198Fix available7.5 High
- geoserverWelcome and About GeoServer pages communicate version and revision informationCVE-2024-35230Fix available5.3 Medium
- geoserver, geotools +1 moreRemote Code Execution (RCE) vulnerability in evaluating property name expressions in GeoserverCVE-2024-36401In KEVPublic exploitFix availableEPSS 99.8%9.8 Critical
- geoserverWPS Server Side Request Forgery in GeoServerCVE-2023-43795Fix availableEPSS 69.0%8.6 High
- geoserverUnsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServerCVE-2023-41339Fix available8.6 High
- geoserverUnfiltered SQL Injection Vulnerabilities in GeoserverCVE-2023-25157Public exploitFix availableEPSS 85.8%9.8 Critical
- osgeo geoserverGeoServer allows SSRF via the option for setting a proxy hostCVE-2021-40822Public exploitEPSS 19.3%7.5 High
- geoserverImproper Input Validation in GeoServerCVE-2022-24847Fix available7.2 High