CVE-2026-45104

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-45104
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45104.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-45104
Aliases
  • GHSA-4h8g-378q-r75m
Downstream
Related
Published
2026-05-27T18:41:39.396Z
Modified
2026-07-08T08:13:30.333907597Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY`
Details

MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls _SLDApplyRuleValues(psRule, psLayer, 1); for any <Rule> carrying <ElseFilter/> — it assumes msSLDParseRule added one class. When the rule has no symbolizer (a structurally valid SLD), msSLDParseRule adds zero, and _SLDApplyRuleValues ends up indexing class[-1], resulting in a NULL pointer dereference. A 200-byte well-formed SLD via the WMS SLDBODY= parameter is enough to trigger this, no auth required. This vulnerability is fixed in 8.6.3.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45104.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-129",
        "CWE-476"
    ]
}
References

Affected packages

Git / github.com/mapserver/mapserver

Affected ranges

Type
GIT
Repo
https://github.com/mapserver/mapserver
Events
Introduced
a098e546885dd7244ce6174ec11e6f0410879a41
Fixed
d83a1b9ce1301e6f941a1a8ea787fd209f7ecfba
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "cpe": "cpe:2.3:a:osgeo:mapserver:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "6.4.0"
        },
        {
            "fixed": "8.6.3"
        }
    ]
}

Affected versions

Other
rel-6-4-0
rel-8-6-0
rel-8-6-0-beta1
rel-8-6-0-beta2
rel-8-6-0-rc1
rel-8-6-1
rel-8-6-2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45104.json"