CVE-2024-36401 CISA KEV · Actively exploited
OSGeo GeoServer GeoTools Eval Injection Vulnerability
CVSS score
—
EPSS probability
%99.8
Risk score
—
Published
2 y ago
Related Security News
Articles and analysis bulletins in which the press and security publications have covered this vulnerability:
GeoNetwork Fixes Unauthenticated RCE Chain Affecting Government Geoportal Backends
Two vulnerabilities in GeoNetwork can be chained to achieve unauthenticated remote code execution (RCE) on the open-source geospatial metadata catalog, which sits behind many government and agency geoportals. The project shipped fixes in versions 4.4.12 and 4.2.17 on July 8, 2026, and published the vulnerability details on August 31. GeoNetwork originated at the United Nations Food and
Similar Vulnerabilities
9.8
CVE-2025-58360 Actively exploitedXML external entity injection in Geoserver
Workaround Public Exploits:1EPSS %60
7.2
CVE-2025-27511Deserialization of untrusted data in Osgeo Geoserver
Patch status unknownEPSS %1
7.2
9.8
CVE-2025-59431SQL injection in Osgeo Mapserver
Patch status unknown Public Exploits:1EPSS %0
8.2
CVE-2025-58175Improper input validation in Osgeo Geoserver
Patch verifiedEPSS %0
5.5
CVE-2026-8213Memory buffer overflow in Osgeo Gdal
Patch verified Public Exploits:2EPSS %0
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2024-36401"