GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions
Priority CRITICAL 88CWE-95Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-95.
Summary
GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the `gt-complex` jar from one's application. As an example of the impact, application schema `datastore` would not function without the ability to use XPath expressions to query complex content. Alternatively, one may utilize a drop-in replacement GeoTools jar from SourceForge for versions 31.1, 30.3, 30.2, 29.2, 28.2, 27.5, 27.4, 26.7, 26.4, 25.2, and 24.0. These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.76065 99th percentileScored 2026-11-07
Fix Fixed geotools (geotools): 29.6, 30.4, 31.2org.geotools:gt-app-schema (Maven): 30.4, 31.2, 29.6 +1+2 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| geotools | geotools | before 29.6; 30.0 to before 30.4; 31.0 to before 31.2 | 29.6, 30.4, 31.2 | Patch available | CNA |
| — | org.geotools:gt-app-schema (Maven) | 30.0 to before 30.4 | 30.4 | Patch available | GHSA-w3pj-wh35-fq8w |
| — | org.geotools:gt-complex (Maven) | 30.0 to before 30.4 | 30.4 | Patch available | GHSA-w3pj-wh35-fq8w |
| — | org.geotools.xsd:gt-xsd-core (Maven) | 30.0 to before 30.4 | 30.4 | Patch available | GHSA-w3pj-wh35-fq8w |
| — | org.geotools:gt-app-schema (Maven) | 31.0 to before 31.2 | 31.2 | Patch available | GHSA-w3pj-wh35-fq8w |
| — | org.geotools:gt-complex (Maven) | 31.0 to before 31.2 | 31.2 | Patch available | GHSA-w3pj-wh35-fq8w |
| — | org.geotools.xsd:gt-xsd-core (Maven) | 31.0 to before 31.2 | 31.2 | Patch available | GHSA-w3pj-wh35-fq8w |
| — | org.geotools:gt-app-schema (Maven) | 29.0 to before 29.6 | 29.6 | Patch available | GHSA-w3pj-wh35-fq8w |
| — | org.geotools:gt-complex (Maven) | 29.0 to before 29.6 | 29.6 | Patch available | GHSA-w3pj-wh35-fq8w |
| — | org.geotools.xsd:gt-xsd-core (Maven) | 29.0 to before 29.6 | 29.6 | Patch available | GHSA-w3pj-wh35-fq8w |
| — | org.geotools:gt-app-schema (Maven) | before 28.6 | 28.6 | Patch available | GHSA-w3pj-wh35-fq8w |
| — | org.geotools:gt-complex (Maven) | before 28.6 | 28.6 | Patch available | GHSA-w3pj-wh35-fq8w |
| — | org.geotools.xsd:gt-xsd-core (Maven) | before 28.6 | 28.6 | Patch available | GHSA-w3pj-wh35-fq8w |
- geotools Vendorgeotools Affected before 29.6; 30.0 to before 30.4; 31.0 to before 31.2 Fixed in 29.6, 30.4, 31.2 Patch available CNA
- org.geotools:gt-app-schema (Maven) Vendor— Affected 30.0 to before 30.4 Fixed in 30.4 Patch available GHSA-w3pj-wh35-fq8w
- org.geotools:gt-complex (Maven) Vendor— Affected 30.0 to before 30.4 Fixed in 30.4 Patch available GHSA-w3pj-wh35-fq8w
- org.geotools.xsd:gt-xsd-core (Maven) Vendor— Affected 30.0 to before 30.4 Fixed in 30.4 Patch available GHSA-w3pj-wh35-fq8w
- org.geotools:gt-app-schema (Maven) Vendor— Affected 31.0 to before 31.2 Fixed in 31.2 Patch available GHSA-w3pj-wh35-fq8w
- org.geotools:gt-complex (Maven) Vendor— Affected 31.0 to before 31.2 Fixed in 31.2 Patch available GHSA-w3pj-wh35-fq8w
- org.geotools.xsd:gt-xsd-core (Maven) Vendor— Affected 31.0 to before 31.2 Fixed in 31.2 Patch available GHSA-w3pj-wh35-fq8w
- org.geotools:gt-app-schema (Maven) Vendor— Affected 29.0 to before 29.6 Fixed in 29.6 Patch available GHSA-w3pj-wh35-fq8w
- org.geotools:gt-complex (Maven) Vendor— Affected 29.0 to before 29.6 Fixed in 29.6 Patch available GHSA-w3pj-wh35-fq8w
- org.geotools.xsd:gt-xsd-core (Maven) Vendor— Affected 29.0 to before 29.6 Fixed in 29.6 Patch available GHSA-w3pj-wh35-fq8w
- org.geotools:gt-app-schema (Maven) Vendor— Affected before 28.6 Fixed in 28.6 Patch available GHSA-w3pj-wh35-fq8w
- org.geotools:gt-complex (Maven) Vendor— Affected before 28.6 Fixed in 28.6 Patch available GHSA-w3pj-wh35-fq8w
- org.geotools.xsd:gt-xsd-core (Maven) Vendor— Affected before 28.6 Fixed in 28.6 Patch available GHSA-w3pj-wh35-fq8w
Remediation
- Fix · CNA geotools (geotools) Fixed in 29.6, 30.4, 31.2
- Fix · GHSA-w3pj-wh35-fq8w org.geotools:gt-app-schema (Maven) Fixed in 30.4 Advisory →
- Fix · GHSA-w3pj-wh35-fq8w org.geotools:gt-complex (Maven) Fixed in 30.4 Advisory →
- Fix · GHSA-w3pj-wh35-fq8w org.geotools.xsd:gt-xsd-core (Maven) Fixed in 30.4 Advisory →
- Fix · GHSA-w3pj-wh35-fq8w org.geotools:gt-app-schema (Maven) Fixed in 31.2 Advisory →
- Fix · GHSA-w3pj-wh35-fq8w org.geotools:gt-complex (Maven) Fixed in 31.2 Advisory →
- Fix · GHSA-w3pj-wh35-fq8w org.geotools.xsd:gt-xsd-core (Maven) Fixed in 31.2 Advisory →
- Fix · GHSA-w3pj-wh35-fq8w org.geotools:gt-app-schema (Maven) Fixed in 29.6 Advisory →
- Fix · GHSA-w3pj-wh35-fq8w org.geotools:gt-complex (Maven) Fixed in 29.6 Advisory →
- Fix · GHSA-w3pj-wh35-fq8w org.geotools.xsd:gt-xsd-core (Maven) Fixed in 29.6 Advisory →
- Fix · GHSA-w3pj-wh35-fq8w org.geotools:gt-app-schema (Maven) Fixed in 28.6 Advisory →
- Fix · GHSA-w3pj-wh35-fq8w org.geotools:gt-complex (Maven) Fixed in 28.6 Advisory →
- Fix · GHSA-w3pj-wh35-fq8w org.geotools.xsd:gt-xsd-core (Maven) Fixed in 28.6 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-36404
- 2026-10-03 Alias added: GHSA-w3pj-wh35-fq8w
References
Other 17
- https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w
- https://github.com/geotools/geotools/pull/4797
- https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea
- https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852
- https://osgeo-org.atlassian.net/browse/GEOT-7587
- https://sourceforge.net/projects/geotools/files/GeoTools%2024%20Releases/24.0/geotools-24.0-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2025%20Releases/25.2/geotools-25.2-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.4
- https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.7/geotools-26.7-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.4/geotools-27.4-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.5/geotools-27.5-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2028%20Releases/28.2/geotools-28.2-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2029%20Releases/29.2/geotools-29.2-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.2/geotools-30.2-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.3/geotools-30.3-patches.zip/download
- https://sourceforge.net/projects/geotools/files/GeoTools%2031%20Releases/31.1
- https://github.com/geotools/geotools
More geotools vulnerabilities
- TI-2024-24187 Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver KEVCVSS 3.1CRITICAL 9.8
- TI-2025-21556 GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling CVSS 3.1CRITICAL 9.9
- TI-2026-53729 GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers CVSS 3.1CRITICAL 9.8
- TI-2023-10620 Unfiltered SQL Injection in Geotools CVSS 3.1CRITICAL 9.8
- TI-2022-08631 Unchecked JNDI lookups in GeoTools CVSS 3.1HIGH 8.2
Sources
- CVE-2024-36404 · CVE Program
- CVE-2024-36404 · NVD
- FIRST EPSS
- GHSA-w3pj-wh35-fq8w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences