CVE-2026-42352

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-42352
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42352.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-42352
Aliases
Published
2026-05-08T22:31:50.110Z
Modified
2026-07-08T08:13:15.488330093Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber
Details

pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, OGC API process execution requests can use the subscriber object to requests to internal HTTP services. This issue has been patched in version 0.23.3.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42352.json",
    "cwe_ids": [
        "CWE-918"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/geopython/pygeoapi

Affected ranges

Type
GIT
Repo
https://github.com/geopython/pygeoapi
Events
Introduced
7ff27c13535a78c034a9569d92361074f02ed2cf
Fixed
a0dcc61664c770fe7b407ddc6daf8d7f93d4dc32
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0.23.0"
        },
        {
            "fixed": "0.23.3"
        }
    ]
}

Affected versions

0.*
0.23.0
0.23.1
0.23.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42352.json"