CVE-2009-2281

CVE-2009-2281 is a critical-severity vulnerability in Osgeo Mapserver with a CVSS 2.0 base score of 10.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-119.

Key facts

• Severity: Critical (CVSS 2.0 base score 10.0)
• EPSS exploit prediction: 6% (92nd percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-119
• Affected product: Osgeo Mapserver
• Published: 2009-10-23
• Last modified: 2026-06-16

Description

Multiple heap-based buffer underflows in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x through 4.10.4 and 5.x before 5.4.2 allow remote attackers to execute arbitrary code via (1) a crafted Content-Length HTTP header or (2) a large HTTP request, related to an integer overflow that triggers a heap-based buffer overflow. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-0840.

Frequently asked questions

What is CVE-2009-2281?

Multiple heap-based buffer underflows in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x through 4.10.4 and 5.x before 5.4.2 allow remote attackers to execute arbitrary code via (1) a crafted Content-Length HTTP header or (2) a large HTTP request, related to an integer overflow that triggers a heap-based buffer overflow. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-0840.

How severe is CVE-2009-2281?

CVE-2009-2281 has a CVSS 2.0 base score of 10.0, rated critical severity.

Is CVE-2009-2281 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 6% (92nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2009-2281?

CVE-2009-2281 primarily affects Osgeo Mapserver. In total, 50 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2009-2281?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2009-2281 published?

CVE-2009-2281 was published on 2009-10-23 and last updated on 2026-06-16.

References

• http://security.debian.org/pool/updates/main/m/mapserver/mapserver_4.10.0-5.1+etch4.diff.gz
• http://security.debian.org/pool/updates/main/m/mapserver/mapserver_5.0.3-3+lenny4.diff.gz
• http://trac.osgeo.org/mapserver/browser/tags/rel-5-4-2/mapserver/HISTORY.TXT
• http://trac.osgeo.org/mapserver/ticket/2943
• http://www.debian.org/security/2009/dsa-1914
• http://www.openwall.com/lists/oss-security/2009/07/01/1
• http://www.openwall.com/lists/oss-security/2009/07/01/6

Affected products (50)

• cpe:2.3:a:osgeo:mapserver:4.2.0:beta1:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:4.4.0:*:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:4.4.0:beta1:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:4.4.0:beta2:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:4.4.0:beta3:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:4.6.0:*:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:4.6.0:beta1:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:4.6.0:beta2:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:4.6.0:beta3:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:4.6.0:rc1:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:4.8.0:beta1:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:4.8.0:beta2:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:4.8.0:beta3:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:4.8.0:rc1:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:4.8.0:rc2:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:4.10.0:*:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:4.10.0:beta1:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:4.10.0:beta2:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:4.10.0:beta3:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:4.10.0:rc1:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:4.10.1:*:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:4.10.2:*:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:4.10.3:*:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:4.10.4:*:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:5.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:5.0.0:beta1:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:5.0.0:beta2:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:5.0.0:beta3:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:5.0.0:beta4:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:5.0.0:beta5:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:5.0.0:beta6:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:5.0.0:rc1:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:5.0.0:rc2:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:5.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:5.2.0:beta1:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:5.2.0:beta2:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:5.2.0:beta3:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:5.2.0:beta4:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:5.2.0:rc1:*:*:*:*:*:*
• cpe:2.3:a:osgeo:mapserver:5.4.0:*:*:*:*:*:*:*

More vulnerabilities in Osgeo Mapserver

• CVE-2010-2540 — Critical (CVSS 10.0): mapserv.c in mapserv in MapServer before 4.10.6 and 5.x before 5.6.4 does not properly restrict the use of CGI…
• CVE-2009-1177 — Critical (CVSS 10.0): Multiple stack-based buffer overflows in maptemplate.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2…
• CVE-2009-1176 — Critical (CVSS 10.0): mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does not ensure that the string holding the id…
• CVE-2009-0841 — Critical (CVSS 10.0): Directory traversal vulnerability in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when…
• CVE-2009-0840 — Critical (CVSS 10.0): Heap-based buffer underflow in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x before 4.10.4 and 5.x…
• CVE-2009-0839 — Critical (CVSS 10.0): Stack-based buffer overflow in mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2, when the…

All CVEs affecting Osgeo Mapserver →

Other CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities

• CVE-2026-2778 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the DOM: Core & HTML component. This vulnerability was fixed in…
• CVE-2026-2776 — Critical (CVSS 10.0): Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability…
• CVE-2025-1866 — Critical (CVSS 10.0): Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in warmcat libwebsockets allows…
• CVE-2022-27625 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
• CVE-2022-27624 — Critical (CVSS 10.0): A vulnerability regarding improper restriction of operations within the bounds of a memory buffer is found in the…
• CVE-2020-11896 — Critical (CVSS 10.0): The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution, related to IPv4 tunneling.

Browse all CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) vulnerabilities →