PatchTheCVEgeoserver vulnerabilities
Recent CVEs affecting geoserver products. 5 tracked.
geoserver has 5 tracked vulnerabilities, 1 critical and 2 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 5. Most recent: 2025-11-25. Highest priority: CVE-2024-36401 (score 97/100).
- CVE-2025-58360 HIGH 8.2 EXPLOITED UPGRADE OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability
- CVE-2025-21621 MEDIUM 6.1 UPGRADE GeoServer is an open source server that allows users to share and edit geospatial data
- CVE-2024-36401 CRITICAL 9.8 EXPLOITED UPGRADE UPGRADE OSGeo GeoServer GeoTools Eval Injection Vulnerability
- CVE-2024-34696 MEDIUM 4.5 UPGRADE GeoServer is an open source server that allows users to share and edit geospatial data
- CVE-2024-24749 HIGH 7.5 UPGRADE GeoServer is an open source server that allows users to share and edit geospatial data
FAQ
How do I fix geoserver vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is geoserver being exploited right now?
Yes: 2 geoserver CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.
Which geoserver CVE should I patch first?
CVE-2024-36401 currently ranks highest (97/100): OSGeo GeoServer GeoTools Eval Injection Vulnerability.