OSGeo vulnerabilities
We track 7 vulnerabilities in OSGeo products across 3 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on June 18, 2026.
Latest OSGeo vulnerabilities
- 8.2 High severity
GeoServer is an open source server that allows users to share and edit geospatial data.
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESOLUTION_ALLOWLIST` may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF). T
- 7.2 High severity
org.geoserver.web:gs-web-app: External Control of File Name or Path
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file nam
- 7.2 High severity
org.geoserver.extension:gs-db2: Improper Neutralization of Special Elements in Output Used by a Downstream Component
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Cod
- 7.8 High severity
gdal: Improper Restriction of Operations within the Bounds of a Memory Buffer
A security flaw has been discovered in OSGeo gdal up to 3.13.0dev-4. Impacted is the function GDnentries of the file frmts/hdf4/hdf-eos/GDapi.c. Performing a manipulation of the argument DataFieldName results in heap-based buffer overflow. The attack must be i
- 7.8 High severity
gdal: Improper Restriction of Operations within the Bounds of a Memory Buffer
A vulnerability was identified in OSGeo gdal up to 3.13.0dev-4. This issue affects the function SWnentries of the file frmts/hdf4/hdf-eos/SWapi.c. Such manipulation of the argument DimensionName leads to heap-based buffer overflow. The attack must be carried o
- 9.4 Critical severity
gdal: Improper Restriction of Operations within the Bounds of a Memory Buffer
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). This vulnerability is associated with program files inftree9.C. This issue affects gdal: before 3.11.0.
- 9.1 Critical severity
geoserver: Improper Restriction of XML External Entity Reference
GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. This impacts whoever exposes XML pro