CVE-2024-36404

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-36404
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-36404.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-36404
Aliases
Published
2024-07-02T13:39:35.716Z
Modified
2026-07-22T03:35:11.459331Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions
Details

GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the gt-complex jar from one's application. As an example of the impact, application schema datastore would not function without the ability to use XPath expressions to query complex content. Alternatively, one may utilize a drop-in replacement GeoTools jar from SourceForge for versions 31.1, 30.3, 30.2, 29.2, 28.2, 27.5, 27.4, 26.7, 26.4, 25.2, and 24.0. These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36404.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-95"
    ]
}
References

Affected packages

Git / github.com/geotools/geotools

Affected ranges

Type
GIT
Repo
https://github.com/geotools/geotools
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
d243ec95b9d23f5b956893366d96581640f44d9b
Introduced
7b3a6ab865e8e49df9d3094516cdc27fe3d21cc3
Fixed
69131bbe4bf72af07dbfb315f145bdcb160ae972
Fixed
3f50a44188a7d9774c555dfb80c9a9e4799972b5
Fixed
c77a759972c0d759d5bd28675a614ada2e3fb774
Fixed
f0c9961dc4d40c5acfce2169fab92805738de5ea
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "29.6"
        },
        {
            "introduced": "30.0"
        },
        {
            "fixed": "30.4"
        },
        {
            "introduced": "31.0"
        },
        {
            "fixed": "31.2"
        }
    ]
}

Affected versions

21.*
21.6b
26.*
26.1a
26.1b

Database specific

vanir_signatures 
[
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "165907299619141433095286212801395621336",
                "134880387732484773581395146083307160821",
                "117197359743944973811807760975766918032",
                "86285282148354647272497821331715210480"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea",
        "signature_type": "Line",
        "target": {
            "file": "modules/extension/xsd/xsd-core/src/test/java/org/geotools/xsd/StreamingParserTest.java"
        },
        "id": "CVE-2024-36404-0457837a",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "187621974535252781870598572552032058791",
                "272582215432120138398435871194174722877",
                "12874552001286729819272458903981135240",
                "337147529503109723334086308295415895972",
                "269396213127288771388332001976694267091",
                "279606661363695231664131820848683042999",
                "17340383552484554097992022619031885868",
                "120223135618051754065352347618372268528",
                "82330553284847404115107857907133658699",
                "175390868197110275029206609598350148541",
                "121574743709197357746470504259611464712",
                "150900628520382503174362443896226283511",
                "273643137491720320207618161387716473062",
                "13685106692743630139531324324684251863",
                "48747881293906924165569786895744722705",
                "101469367763935824707085728738345025266",
                "201537305686685691556243710220210906514",
                "148063291334435769594401731008616126294",
                "139227277442940221770917044905914590682",
                "118747858805124738217065534808787321755",
                "189702695894553477456102268829587699001",
                "158353463830471408098386870652112683545",
                "104254310384547605683219302462841380924",
                "212055385620327511984330380056993743218",
                "264395274440856369410853269226618118361",
                "60261452247838071153575468224030421657",
                "31727103543981183580245286356824292753",
                "69562534217716097794458895960692831343",
                "104336865837789685281781432480252999328",
                "118747858805124738217065534808787321755",
                "189702695894553477456102268829587699001",
                "158353463830471408098386870652112683545",
                "104254310384547605683219302462841380924",
                "4054735050707473224621407745847501069",
                "325341938978515091745050017622518858295",
                "214346917553085049591978616969097512023"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea",
        "signature_type": "Line",
        "target": {
            "file": "modules/extension/complex/src/main/java/org/geotools/data/complex/expression/FeaturePropertyAccessorFactory.java"
        },
        "id": "CVE-2024-36404-07a87277",
        "deprecated": false
    },
    {
        "digest": {
            "length": 137.0,
            "function_hash": "131624959010635517621007970688817393061"
        },
        "signature_version": "v1",
        "source": "https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea",
        "signature_type": "Function",
        "target": {
            "function": "getXPathValues",
            "file": "modules/extension/app-schema/app-schema/src/main/java/org/geotools/appschema/util/XmlXpathUtilites.java"
        },
        "id": "CVE-2024-36404-09031e04",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "55695732998737747712853899220233490321",
                "281933552170580288908074053571278813697",
                "324685869201068105117061984702883929588",
                "114803178106247318719659931660016968726"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea",
        "signature_type": "Line",
        "target": {
            "file": "modules/extension/complex/src/test/java/org/geotools/filter/expression/FeaturePropertyAccessorTest.java"
        },
        "id": "CVE-2024-36404-0f2a6c73",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "58331193820303226550130933538173528039",
                "394364551565184631066212644982036379",
                "300799102261326499807791851822318650773",
                "306296544572337958321974931685154099779",
                "34238041766103832525936717355048496702",
                "217538637650435973726605642112404098040",
                "238984632498643711417208870013389848557",
                "93718462253234432131919040177086519225",
                "277821435507599783714576229921440044393",
                "324652399097926423667806815985032937189",
                "315405617301896105931858161287923695646",
                "255897784229195091379910676094764309961",
                "66265677291229474733823785091265006325",
                "145579585722297177376086990654100772823",
                "334372858854252073802742866116261722998",
                "104180030836300360888777472201463616085",
                "66825517613540610476818927965888402307",
                "134817557359981368928208590767198545961",
                "159085734091151968180101302357445900000",
                "146205371772470905759360488864195214927",
                "150066935083748513864372012892295845123",
                "332797080872400285846643403404905851502",
                "301840173854033007127563557149874083282",
                "267156794817753882408379260229099790568",
                "100992109300640792776364501949001860549",
                "28584919952451599880553626339021903411",
                "279129235775733894534239135873085552196",
                "34372960437894488776324010182122785601",
                "191582488535788611441520483867988640113",
                "107785285250088471073228731179311503395",
                "237550997751088172040845324179034950957",
                "273651357848699373357569001014573925956",
                "4562873903389790022743880644460619957",
                "87803259265698268222028268878813819815"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea",
        "signature_type": "Line",
        "target": {
            "file": "modules/extension/app-schema/app-schema/src/main/java/org/geotools/appschema/util/XmlXpathUtilites.java"
        },
        "id": "CVE-2024-36404-3943300e",
        "deprecated": false
    },
    {
        "digest": {
            "length": 256.0,
            "function_hash": "169055231625421857249352023435906051737"
        },
        "signature_version": "v1",
        "source": "https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea",
        "signature_type": "Function",
        "target": {
            "function": "addNamespaces",
            "file": "modules/extension/app-schema/app-schema/src/main/java/org/geotools/appschema/util/XmlXpathUtilites.java"
        },
        "id": "CVE-2024-36404-43b1938d",
        "deprecated": false
    },
    {
        "digest": {
            "length": 289.0,
            "function_hash": "34053054091653021517596263668149257741"
        },
        "signature_version": "v1",
        "source": "https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea",
        "signature_type": "Function",
        "target": {
            "function": "getSingleXPathValue",
            "file": "modules/extension/app-schema/app-schema/src/main/java/org/geotools/appschema/util/XmlXpathUtilites.java"
        },
        "id": "CVE-2024-36404-45d097a8",
        "deprecated": false
    },
    {
        "digest": {
            "length": 440.0,
            "function_hash": "203604283927106497732781781744848104864"
        },
        "signature_version": "v1",
        "source": "https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea",
        "signature_type": "Function",
        "target": {
            "function": "stream",
            "file": "modules/extension/xsd/xsd-core/src/main/java/org/geotools/xsd/impl/jxpath/JXPathStreamingParserHandler.java"
        },
        "id": "CVE-2024-36404-51f92af3",
        "deprecated": false
    },
    {
        "digest": {
            "length": 689.0,
            "function_hash": "58365756538891482418447269657624363950"
        },
        "signature_version": "v1",
        "source": "https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea",
        "signature_type": "Function",
        "target": {
            "function": "createPropertyAccessor",
            "file": "modules/extension/complex/src/main/java/org/geotools/data/complex/expression/FeaturePropertyAccessorFactory.java"
        },
        "id": "CVE-2024-36404-5fc6adb8",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "110946196381830508870115048132751320855",
                "243542029989291947393671014788335794916",
                "96424671123553436956338702090265883078",
                "38613902828296272556397260762737432542",
                "305740405151962379053854704299410111844",
                "130468088285617422567092431148915941747",
                "256233530770147959359733538978940936793",
                "201537305686685691556243710220210906514",
                "5468470192551646293652701568786015134",
                "257700286907916463795700687055487556076",
                "31302047595768171603019731139338491016",
                "73928698598255223713422641944285115319",
                "6763357680286193921298658318311876507"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea",
        "signature_type": "Line",
        "target": {
            "file": "modules/extension/complex/src/main/java/org/geotools/data/complex/expression/MapPropertyAccessorFactory.java"
        },
        "id": "CVE-2024-36404-6ad03392",
        "deprecated": false
    },
    {
        "digest": {
            "length": 155.0,
            "function_hash": "41773064778501217759141532714969604266"
        },
        "signature_version": "v1",
        "source": "https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea",
        "signature_type": "Function",
        "target": {
            "function": "initialiseContext",
            "file": "modules/extension/app-schema/app-schema/src/main/java/org/geotools/appschema/util/XmlXpathUtilites.java"
        },
        "id": "CVE-2024-36404-83ec4a5a",
        "deprecated": false
    },
    {
        "digest": {
            "length": 5682.0,
            "function_hash": "263267591646958284468305080166232823735"
        },
        "signature_version": "v1",
        "source": "https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea",
        "signature_type": "Function",
        "target": {
            "function": "testComplexFeature",
            "file": "modules/extension/complex/src/test/java/org/geotools/filter/expression/FeaturePropertyAccessorTest.java"
        },
        "id": "CVE-2024-36404-927c9a39",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "66851917935397703547817473261787597005",
                "152498202100233394359199576862837137901",
                "161868867185921584257211038435442067319",
                "205891953986089536679096082900492631560",
                "258300061174553869830146607965006960870",
                "20657505470729290125819176660202758930",
                "191205002656604650334798051664091126711",
                "262130277724956983177699979466901475193",
                "332040615185725942327671578556693489342",
                "339897851626676679230775863728148240785"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea",
        "signature_type": "Line",
        "target": {
            "file": "modules/extension/xsd/xsd-core/src/main/java/org/geotools/xsd/impl/jxpath/JXPathStreamingParserHandler.java"
        },
        "id": "CVE-2024-36404-b3c7d3e8",
        "deprecated": false
    },
    {
        "digest": {
            "length": 205.0,
            "function_hash": "21767457950466104807402146594265560013"
        },
        "signature_version": "v1",
        "source": "https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea",
        "signature_type": "Function",
        "target": {
            "function": "get",
            "file": "modules/extension/complex/src/main/java/org/geotools/data/complex/expression/MapPropertyAccessorFactory.java"
        },
        "id": "CVE-2024-36404-b4fb67af",
        "deprecated": false
    },
    {
        "digest": {
            "length": 790.0,
            "function_hash": "111918782868674271571631588504784013308"
        },
        "signature_version": "v1",
        "source": "https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea",
        "signature_type": "Function",
        "target": {
            "function": "get",
            "file": "modules/extension/complex/src/main/java/org/geotools/data/complex/expression/FeaturePropertyAccessorFactory.java"
        },
        "id": "CVE-2024-36404-f13bf6c6",
        "deprecated": false
    },
    {
        "digest": {
            "length": 496.0,
            "function_hash": "95767279845706205617721871698934906217"
        },
        "signature_version": "v1",
        "source": "https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea",
        "signature_type": "Function",
        "target": {
            "function": "set",
            "file": "modules/extension/complex/src/main/java/org/geotools/data/complex/expression/FeaturePropertyAccessorFactory.java"
        },
        "id": "CVE-2024-36404-f799ad60",
        "deprecated": false
    }
]
vanir_signatures_modified 
"2026-07-22T03:35:11Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-36404.json"