{"action":"Upgrade org.geotools:gt-complex to 28.6 (28.x), 29.6 (29.x), 30.4 (30.x) or 31.2 (31.x) or later.","affected":[{"fixed":"30.4","introduced":"30.0"},{"fixed":"31.2","introduced":"31.0"},{"fixed":"29.6","introduced":"29.0"},{"fixed":"28.6","introduced":"0"}],"component":"org.geotools:gt-complex","cve_ids":["CVE-2024-36404"],"ecosystem":"Maven","epss":0.76065,"exploited":false,"fixed_versions":["30.4","31.2","29.6","28.6"],"ghsa_id":"GHSA-w3pj-wh35-fq8w","id":"tcs_01M5N9FC1WJBV9ACF8XRZ9CN57","modified_at":"2026-02-04T04:20:56.470774Z","published_at":"2025-02-05T15:32:02Z","references":["https://osv.dev/vulnerability/GHSA-w3pj-wh35-fq8w","https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w","https://nvd.nist.gov/vuln/detail/CVE-2024-36404","https://github.com/geotools/geotools/pull/4797","https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea","https://sourceforge.net/projects/geotools/files/GeoTools%2031%20Releases/31.1","https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.3/geotools-30.3-patches.zip/download","https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.2/geotools-30.2-patches.zip/download","https://sourceforge.net/projects/geotools/files/GeoTools%2029%20Releases/29.2/geotools-29.2-patches.zip/download","https://sourceforge.net/projects/geotools/files/GeoTools%2028%20Releases/28.2/geotools-28.2-patches.zip/download","https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.5/geotools-27.5-patches.zip/download","https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.4/geotools-27.4-patches.zip/download","https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.7/geotools-26.7-patches.zip/download","https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.4","https://sourceforge.net/projects/geotools/files/GeoTools%2025%20Releases/25.2/geotools-25.2-patches.zip/download","https://sourceforge.net/projects/geotools/files/GeoTools%2024%20Releases/24.0/geotools-24.0-patches.zip/download","https://osgeo-org.atlassian.net/browse/GEOT-7587","https://github.com/geotools/geotools","https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-w3pj-wh35-fq8w#Maven/org.geotools:gt-complex","url":"https://osv.dev/vulnerability/GHSA-w3pj-wh35-fq8w"}],"summary":"GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions"}