CVE-2024-34711

Summary

GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)

Severity

critical

EPSS

0.3% (p17)

Also known as

GHSA-mc43-4fqr-c965#org.geoserver.main:gs-main, GHSA-mc43-4fqr-c965#org.geoserver.web:gs-web-app

Published

2025-06-10

References

• https://github.com/geoserver/geoserver/security/advisories/GHSA-mc43-4fqr-c965
• https://nvd.nist.gov/vuln/detail/CVE-2024-34711
• https://docs.geoserver.org/latest/en/user/production/config.html#production-config-external-entities

Related advisories

• CVE-2024-36401 — critical · Maven/org.geoserver.web:gs-web-app
• CVE-2025-52465 — high · Maven/org.geoserver.web:gs-web-app
• CVE-2025-58360 — high · Maven/org.geoserver.web:gs-web-app
• CVE-2025-30220 — high · Maven/org.geoserver.web:gs-web-app
• CVE-2025-30145 — high · Maven/org.geoserver.web:gs-web-app
• CVE-2024-24749 — high · Maven/org.geoserver.web:gs-web-app
• CVE-2025-58175 — medium · Maven/org.geoserver.web:gs-web-app
• CVE-2025-21621 — medium · Maven/org.geoserver.web:gs-web-app

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity