CVE-2024-36404
CriticalGeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions
Published Feb 5, 2025 · Updated Aug 12, 2026 · Also known as GHSA-w3pj-wh35-fq8w
Key Facts
Patch immediately- CVE-2024-36404 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting org.geotools:gt-app-schema (maven), org.geotools:gt-complex (maven), org.geotools.xsd:gt-xsd-core (maven) and 1 more product.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 76% probability of exploitation in the next 30 days.
- Fixed versions are available, including org.geotools:gt-app-schema 28.6, org.geotools:gt-app-schema 29.6, org.geotools:gt-app-schema 30.4.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
76%
Higher than 99.5% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2024-36404 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the gt-complex jar from one's application. As an example of the impact, application schema datastore would not function without the ability to use XPath expressions to query complex content. Alternatively, one may utilize a drop-in replacement GeoTools jar from SourceForge for versions 31.1, 30.3, 30.2, 29.2, 28.2, 27.5, 27.4, 26.7, 26.4, 25.2, and 24.0. These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications.
Affected Products
4 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| org.geotools:gt-app-schemamaven | >= 30.0 | 28.6 |
| org.geotools:gt-complexmaven | >= 30.0 | 28.6 |
| org.geotools.xsd:gt-xsd-coremaven | >= 30.0 | 28.6 |
| geotools | >= < 29.6 | n/a |
Patched Releases
org.geotools:gt-app-schema
28.6, 29.6, 30.4, 31.2
org.geotools:gt-complex
28.6, 29.6, 30.4, 31.2
org.geotools.xsd:gt-xsd-core
28.6, 29.6, 30.4, 31.2
Timeline
Publicly disclosed
Feb 5, 2025
Last updated
Aug 12, 2026
Weakness Type
- CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36404.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2024-36404
- articlehttps://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea
- articlehttps://github.com/geotools/geotools/pull/4797
FAQ
Common Questions.
GeoTools is an open source Java library that provides tools for geospatial data.
Affected: org.geotools:gt-app-schema (maven) versions >= 30.0; org.geotools:gt-complex (maven) versions >= 30.0; org.geotools.xsd:gt-xsd-core (maven) versions >= 30.0, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including org.geotools:gt-app-schema 28.6, org.geotools:gt-app-schema 29.6, org.geotools:gt-app-schema 30.4.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2024-36404 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo