Description
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| geoserver | org.geoserver.extension:gs-db2 | < 2.27.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.geoserver.extension:gs-db2 | < 2.27.0 | 2.27.0 | GHSA-g628-r368-6vh7 |
Advisories 1
- WID-SEC-2026-1902 GeoServer: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 18, 2026