{"id":"CVE-2024-36404","summary":"GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions","details":"GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the `gt-complex` jar from one's application. As an example of the impact, application schema `datastore` would not function without the ability to use XPath expressions to query complex content. Alternatively, one may utilize a drop-in replacement GeoTools jar from SourceForge for versions 31.1, 30.3, 30.2, 29.2, 28.2, 27.5, 27.4, 26.7, 26.4, 25.2, and 24.0. These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications.","aliases":["GHSA-w3pj-wh35-fq8w"],"modified":"2026-08-12T15:16:00.763675Z","published":"2024-07-02T13:39:35.716Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-95"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36404.json"},"references":[{"type":"WEB","url":"https://osgeo-org.atlassian.net/browse/GEOT-7587"},{"type":"WEB","url":"https://sourceforge.net/projects/geotools/files/GeoTools%2024%20Releases/24.0/geotools-24.0-patches.zip/download"},{"type":"WEB","url":"https://sourceforge.net/projects/geotools/files/GeoTools%2025%20Releases/25.2/geotools-25.2-patches.zip/download"},{"type":"WEB","url":"https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.4"},{"type":"WEB","url":"https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.7/geotools-26.7-patches.zip/download"},{"type":"WEB","url":"https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.4/geotools-27.4-patches.zip/download"},{"type":"WEB","url":"https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.5/geotools-27.5-patches.zip/download"},{"type":"WEB","url":"https://sourceforge.net/projects/geotools/files/GeoTools%2028%20Releases/28.2/geotools-28.2-patches.zip/download"},{"type":"WEB","url":"https://sourceforge.net/projects/geotools/files/GeoTools%2029%20Releases/29.2/geotools-29.2-patches.zip/download"},{"type":"WEB","url":"https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.2/geotools-30.2-patches.zip/download"},{"type":"WEB","url":"https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.3/geotools-30.3-patches.zip/download"},{"type":"WEB","url":"https://sourceforge.net/projects/geotools/files/GeoTools%2031%20Releases/31.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36404.json"},{"type":"ADVISORY","url":"https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36404"},{"type":"FIX","url":"https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea"},{"type":"FIX","url":"https://github.com/geotools/geotools/pull/4797"},{"type":"PACKAGE","url":"https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/geotools/geotools","events":[{"introduced":"0"},{"introduced":"d243ec95b9d23f5b956893366d96581640f44d9b"},{"introduced":"7b3a6ab865e8e49df9d3094516cdc27fe3d21cc3"},{"fixed":"69131bbe4bf72af07dbfb315f145bdcb160ae972"},{"fixed":"3f50a44188a7d9774c555dfb80c9a9e4799972b5"},{"fixed":"c77a759972c0d759d5bd28675a614ada2e3fb774"},{"fixed":"f0c9961dc4d40c5acfce2169fab92805738de5ea"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"29.6"},{"introduced":"30.0"},{"fixed":"30.4"},{"introduced":"31.0"},{"fixed":"31.2"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["26.1b","21.6b","26.1a"],"database_specific":{"vanir_signatures":[{"target":{"file":"modules/extension/xsd/xsd-core/src/test/java/org/geotools/xsd/StreamingParserTest.java"},"deprecated":false,"digest":{"line_hashes":["165907299619141433095286212801395621336","134880387732484773581395146083307160821","117197359743944973811807760975766918032","86285282148354647272497821331715210480"],"threshold":0.9},"id":"CVE-2024-36404-0457837a","signature_type":"Line","signature_version":"v1","source":"https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea"},{"deprecated":false,"digest":{"line_hashes":["187621974535252781870598572552032058791","272582215432120138398435871194174722877","12874552001286729819272458903981135240","337147529503109723334086308295415895972","269396213127288771388332001976694267091","279606661363695231664131820848683042999","17340383552484554097992022619031885868","120223135618051754065352347618372268528","82330553284847404115107857907133658699","175390868197110275029206609598350148541","121574743709197357746470504259611464712","150900628520382503174362443896226283511","273643137491720320207618161387716473062","13685106692743630139531324324684251863","48747881293906924165569786895744722705","101469367763935824707085728738345025266","201537305686685691556243710220210906514","148063291334435769594401731008616126294","139227277442940221770917044905914590682","118747858805124738217065534808787321755","189702695894553477456102268829587699001","158353463830471408098386870652112683545","104254310384547605683219302462841380924","212055385620327511984330380056993743218","264395274440856369410853269226618118361","60261452247838071153575468224030421657","31727103543981183580245286356824292753","69562534217716097794458895960692831343","104336865837789685281781432480252999328","118747858805124738217065534808787321755","189702695894553477456102268829587699001","158353463830471408098386870652112683545","104254310384547605683219302462841380924","4054735050707473224621407745847501069","325341938978515091745050017622518858295","214346917553085049591978616969097512023"],"threshold":0.9},"id":"CVE-2024-36404-07a87277","signature_type":"Line","signature_version":"v1","source":"https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea","target":{"file":"modules/extension/complex/src/main/java/org/geotools/data/complex/expression/FeaturePropertyAccessorFactory.java"}},{"digest":{"function_hash":"131624959010635517621007970688817393061","length":137},"id":"CVE-2024-36404-09031e04","signature_type":"Function","signature_version":"v1","source":"https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea","target":{"file":"modules/extension/app-schema/app-schema/src/main/java/org/geotools/appschema/util/XmlXpathUtilites.java","function":"getXPathValues"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["55695732998737747712853899220233490321","281933552170580288908074053571278813697","324685869201068105117061984702883929588","114803178106247318719659931660016968726"],"threshold":0.9},"id":"CVE-2024-36404-0f2a6c73","signature_type":"Line","signature_version":"v1","source":"https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea","target":{"file":"modules/extension/complex/src/test/java/org/geotools/filter/expression/FeaturePropertyAccessorTest.java"}},{"id":"CVE-2024-36404-3943300e","signature_type":"Line","signature_version":"v1","source":"https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea","target":{"file":"modules/extension/app-schema/app-schema/src/main/java/org/geotools/appschema/util/XmlXpathUtilites.java"},"deprecated":false,"digest":{"line_hashes":["58331193820303226550130933538173528039","394364551565184631066212644982036379","300799102261326499807791851822318650773","306296544572337958321974931685154099779","34238041766103832525936717355048496702","217538637650435973726605642112404098040","238984632498643711417208870013389848557","93718462253234432131919040177086519225","277821435507599783714576229921440044393","324652399097926423667806815985032937189","315405617301896105931858161287923695646","255897784229195091379910676094764309961","66265677291229474733823785091265006325","145579585722297177376086990654100772823","334372858854252073802742866116261722998","104180030836300360888777472201463616085","66825517613540610476818927965888402307","134817557359981368928208590767198545961","159085734091151968180101302357445900000","146205371772470905759360488864195214927","150066935083748513864372012892295845123","332797080872400285846643403404905851502","301840173854033007127563557149874083282","267156794817753882408379260229099790568","100992109300640792776364501949001860549","28584919952451599880553626339021903411","279129235775733894534239135873085552196","34372960437894488776324010182122785601","191582488535788611441520483867988640113","107785285250088471073228731179311503395","237550997751088172040845324179034950957","273651357848699373357569001014573925956","4562873903389790022743880644460619957","87803259265698268222028268878813819815"],"threshold":0.9}},{"digest":{"function_hash":"169055231625421857249352023435906051737","length":256},"id":"CVE-2024-36404-43b1938d","signature_type":"Function","signature_version":"v1","source":"https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea","target":{"file":"modules/extension/app-schema/app-schema/src/main/java/org/geotools/appschema/util/XmlXpathUtilites.java","function":"addNamespaces"},"deprecated":false},{"digest":{"function_hash":"34053054091653021517596263668149257741","length":289},"id":"CVE-2024-36404-45d097a8","signature_type":"Function","signature_version":"v1","source":"https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea","target":{"file":"modules/extension/app-schema/app-schema/src/main/java/org/geotools/appschema/util/XmlXpathUtilites.java","function":"getSingleXPathValue"},"deprecated":false},{"source":"https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea","target":{"file":"modules/extension/xsd/xsd-core/src/main/java/org/geotools/xsd/impl/jxpath/JXPathStreamingParserHandler.java","function":"stream"},"deprecated":false,"digest":{"function_hash":"203604283927106497732781781744848104864","length":440},"id":"CVE-2024-36404-51f92af3","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea","target":{"file":"modules/extension/complex/src/main/java/org/geotools/data/complex/expression/FeaturePropertyAccessorFactory.java","function":"createPropertyAccessor"},"deprecated":false,"digest":{"function_hash":"58365756538891482418447269657624363950","length":689},"id":"CVE-2024-36404-5fc6adb8","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2024-36404-6ad03392","signature_type":"Line","signature_version":"v1","source":"https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea","target":{"file":"modules/extension/complex/src/main/java/org/geotools/data/complex/expression/MapPropertyAccessorFactory.java"},"deprecated":false,"digest":{"line_hashes":["110946196381830508870115048132751320855","243542029989291947393671014788335794916","96424671123553436956338702090265883078","38613902828296272556397260762737432542","305740405151962379053854704299410111844","130468088285617422567092431148915941747","256233530770147959359733538978940936793","201537305686685691556243710220210906514","5468470192551646293652701568786015134","257700286907916463795700687055487556076","31302047595768171603019731139338491016","73928698598255223713422641944285115319","6763357680286193921298658318311876507"],"threshold":0.9}},{"target":{"file":"modules/extension/app-schema/app-schema/src/main/java/org/geotools/appschema/util/XmlXpathUtilites.java","function":"initialiseContext"},"deprecated":false,"digest":{"function_hash":"41773064778501217759141532714969604266","length":155},"id":"CVE-2024-36404-83ec4a5a","signature_type":"Function","signature_version":"v1","source":"https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea"},{"id":"CVE-2024-36404-927c9a39","signature_type":"Function","signature_version":"v1","source":"https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea","target":{"function":"testComplexFeature","file":"modules/extension/complex/src/test/java/org/geotools/filter/expression/FeaturePropertyAccessorTest.java"},"deprecated":false,"digest":{"function_hash":"263267591646958284468305080166232823735","length":5682}},{"signature_version":"v1","source":"https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea","target":{"file":"modules/extension/xsd/xsd-core/src/main/java/org/geotools/xsd/impl/jxpath/JXPathStreamingParserHandler.java"},"deprecated":false,"digest":{"line_hashes":["66851917935397703547817473261787597005","152498202100233394359199576862837137901","161868867185921584257211038435442067319","205891953986089536679096082900492631560","258300061174553869830146607965006960870","20657505470729290125819176660202758930","191205002656604650334798051664091126711","262130277724956983177699979466901475193","332040615185725942327671578556693489342","339897851626676679230775863728148240785"],"threshold":0.9},"id":"CVE-2024-36404-b3c7d3e8","signature_type":"Line"},{"id":"CVE-2024-36404-b4fb67af","signature_type":"Function","signature_version":"v1","source":"https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea","target":{"file":"modules/extension/complex/src/main/java/org/geotools/data/complex/expression/MapPropertyAccessorFactory.java","function":"get"},"deprecated":false,"digest":{"function_hash":"21767457950466104807402146594265560013","length":205}},{"deprecated":false,"digest":{"function_hash":"111918782868674271571631588504784013308","length":790},"id":"CVE-2024-36404-f13bf6c6","signature_type":"Function","signature_version":"v1","source":"https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea","target":{"file":"modules/extension/complex/src/main/java/org/geotools/data/complex/expression/FeaturePropertyAccessorFactory.java","function":"get"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea","target":{"file":"modules/extension/complex/src/main/java/org/geotools/data/complex/expression/FeaturePropertyAccessorFactory.java","function":"set"},"deprecated":false,"digest":{"function_hash":"95767279845706205617721871698934906217","length":496},"id":"CVE-2024-36404-f799ad60"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-36404.json","vanir_signatures_modified":"2026-08-12T15:16:00Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}