GeoServer
Security incidents tagged GeoServer. Newest first.
1 GeoServer incident in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 2
- Live
- 0
- Patched
- 2
- Days without an incident
- 316
- Longest quiet run: 513 days (Jul 16–Dec 10)
Show 2 older incidents2 older incidents
December 2025 1
PatchedOSGeo GeoServer: GeoServer Improper Restriction of XML External Entity Reference Vulnerability
OSGeo GeoServer
OSGeo GeoServer contains an improper restriction of XML external entity reference vulnerability that occurs when the application accepts XML input through a specific endpoint /geoserver/wms operation GetMap and could allow an attacker to define external entities within the XML request. Added to CISA KEV on 2025-12-11.
Open incident →CVE-2025-58360
July 2024 1
PatchedOSGeo GeoServer GeoTools Eval Injection
OSGeo GeoServer
OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input. Added to the CISA KEV catalog on 2024-07-15.
Open incident →CVE-2024-36401
