org.geoserver:gs-main (Maven) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the Maven package org.geoserver:gs-main, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (6)

• CVE-2021-40822 — CVSS 7.5 (high): GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host.
• CVE-2022-24847 — CVSS 7.2 (high): GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security…
• CVE-2023-41877 — CVSS 7.2 (high): GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A path traversal…
• CVE-2025-58175 — CVSS 6.5 (medium): GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer…
• CVE-2024-23640 — CVSS 4.8 (medium): GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A stored cross-site…
• CVE-2024-34696 — CVSS 4.5 (medium): GeoServer is an open source server that allows users to share and edit geospatial data. Starting in version 2.10.0 and prior to versions…