geotools vulnerabilities and fixes

Recent CVEs affecting geotools, with upgrade or downgrade steps. 2 tracked.

geotools has 2 tracked vulnerabilities, 2 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 2. Most recent: 2025-06-10. Highest priority: CVE-2024-36401 (score 97/100).

• CVE-2025-30220 CRITICAL 9.9 UPGRADE UPGRADE GeoServer is an open source server that allows users to share and edit geospatial data
• CVE-2024-36401 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE OSGeo GeoServer GeoTools Eval Injection Vulnerability

FAQ

How do I fix geotools vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is geotools being exploited right now?

Yes: 1 geotools CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.

Which geotools CVE should I patch first?

CVE-2024-36401 currently ranks highest (97/100): OSGeo GeoServer GeoTools Eval Injection Vulnerability.

← Back to latest CVEs