CVE-2024-36401: OSGeo GeoServer GeoTools Eval Injection Vulnerability

Q: How do I fix CVE-2024-36401?

geoserver: upgrade to 2.22.6, 2.23.6, 2.24.4, 2.25.2; geotools: upgrade to 29.6, 30.4, 31.2. Exact commands for each OS are on this page.

Q: Is CVE-2024-36401 being exploited?

Yes. CVE-2024-36401 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

Q: What does CVE-2024-36401 affect?

CVE-2024-36401 affects geoserver, geotools. Severity is critical (CVSS 9.8). GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through

Q: How urgent is CVE-2024-36401?

Priority 97/100. Critical severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

Patch now

CRITICAL 9.8EXPLOITEDREMOTEUPGRADEUPGRADE

CVE-2024-36401 is a critical-severity flaw (CVSS 9.8) affecting geoserver, geotools, reported as exploited in the wild. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls evaluates property/attribute name

Why this priority

Critical severity
EPSS top 1%: very likely to be exploited
Exploited in the wild (CISA KEV)
Public exploit reference
CISA SSVC: automatable with total technical impact
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	99.8% (top 1%)
CISA exploited list	Yes, fix due 2024-08-05
Weakness	CWE-95, CWE-94
Published	2024-07-01
Last modified	2026-06-17

Publisher (CNA): GitHub, Inc. · Vendor: geoserver · geotools

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2024-07-01 16:15 UTCPublished CVE record published
2024-07-15Exploited Added to the CISA Known Exploited Vulnerabilities list
2024-08-05Deadline CISA due date for US federal agencies to patch
2026-06-17 07:36 UTCUpdated Record last modified

geoserver geoserver UPGRADE

Affected: < 2.22.6 · >= 2.23.0 and < 2.23.6 · >= 2.24.0 and < 2.24.4 · >= 2.25.0 and < 2.25.2

Fixed in: 2.22.6, 2.23.6, 2.24.4, 2.25.2

Safe to downgrade to: a release before 2.23.0

1. Check installed version

apt-cache policy geoserver || rpm -q geoserver || geoserver --version

2. UPGRADE to 2.22.6 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade geoserver

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade geoserver

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 2.23.0 (Debian / Ubuntu)

apt-cache madison geoserver sudo apt install geoserver=<VERSION_BEFORE_2.23.0> sudo apt-mark hold geoserver

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list geoserver sudo dnf downgrade geoserver-<VERSION_BEFORE_2.23.0> sudo dnf versionlock add geoserver

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

geotools geotools UPGRADE

Affected: < 29.6 · >= 30.1 and < 30.4 · >= 31.1 and < 31.2 · 30.0 · 30.0 rc · 31.0 · 31.0 rc

Fixed in: 29.6, 30.4, 31.2

Safe to downgrade to: a release before 30.0

1. Check installed version

apt-cache policy geotools || rpm -q geotools || geotools --version

2. UPGRADE to 29.6 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade geotools

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade geotools

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 30.0 (Debian / Ubuntu)

apt-cache madison geotools sudo apt install geotools=<VERSION_BEFORE_30.0> sudo apt-mark hold geotools

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list geotools sudo dnf downgrade geotools-<VERSION_BEFORE_30.0> sudo dnf versionlock add geotools

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Exact fixes by distribution

Maven · org.geoserver.web:gs-web-app · FIXED · 2.24.4 · vulnerable: >= 2.24.0, < 2.24.4 · source

Set org.geoserver.web:gs-web-app to 2.24.4 or later in pom.xml or build.gradle, then rebuild and redeploy.

Maven · org.geoserver:gs-wfs · FIXED · 2.24.4 · vulnerable: >= 2.24.0, < 2.24.4 · source

Set org.geoserver:gs-wfs to 2.24.4 or later in pom.xml or build.gradle, then rebuild and redeploy.

Maven · org.geoserver:gs-wms · FIXED · 2.24.4 · vulnerable: >= 2.24.0, < 2.24.4 · source

Set org.geoserver:gs-wms to 2.24.4 or later in pom.xml or build.gradle, then rebuild and redeploy.

Fedora ELN · gram_grep · FIXED · 0.10.4-1.eln159 · FEDORA-2026-0808475f2a · source

sudo dnf upgrade --advisory=FEDORA-2026-0808475f2a

Fedora 46 · wesnoth · FIXED · 1.19.29-1.fc46 · FEDORA-2026-58f458e24e · source

sudo dnf upgrade --advisory=FEDORA-2026-58f458e24e

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

GitHub PoC: whitebear-ch/GeoServerExploit (123 stars)
GitHub PoC: Chocapikk/CVE-2024-36401 (89 stars)
GitHub PoC: Mr-xn/CVE-2024-36401 (56 stars)
Write-up: github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852
Write-up: github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv
Write-up: github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w
Metasploit: Geoserver unauthenticated Remote Code Execution
Nuclei scan template: GeoServer RCE in Evaluating Property Name Expressions

Verify at the official source NVD · CVE Program · CISA KEV catalog · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2024-36401?

geoserver: upgrade to 2.22.6, 2.23.6, 2.24.4, 2.25.2; geotools: upgrade to 29.6, 30.4, 31.2. Exact commands for each OS are on this page.

Is CVE-2024-36401 being exploited?

Yes. CVE-2024-36401 is on the CISA Known Exploited Vulnerabilities list, so treat it as patch-now.

What does CVE-2024-36401 affect?

CVE-2024-36401 affects geoserver, geotools. Severity is critical (CVSS 9.8). GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through

How urgent is CVE-2024-36401?

Priority 97/100. Critical severity; EPSS top 1%: very likely to be exploited; Exploited in the wild (CISA KEV); Public exploit reference; CISA SSVC: automatable with total technical impact; Remotely exploitable, no login, no user action

Related CVEs

CVE-2025-58360 HIGH 8.2 EXPLOITED UPGRADE OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability
CVE-2025-21621 MEDIUM 6.1 UPGRADE GeoServer is an open source server that allows users to share and edit geospatial data
CVE-2025-27511 HIGH 7.2 UPGRADE GeoServer is an open source server that allows users to share and edit geospatial data
CVE-2025-52465 HIGH 7.2 UPGRADE GeoServer is an open source server that allows users to share and edit geospatial data
CVE-2025-58175 MEDIUM 6.5 UPGRADE GeoServer is an open source server that allows users to share and edit geospatial data

References

← Back to latest CVEs