CVE-2025-27511: CWE-502: Deserialization of Untrusted Data in geoserver org.geoserver.extension:gs-db2
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue.
AI Analysis
Technical Summary
CVE-2025-27511 affects the GeoServer DB2 DataStore Extension (org.geoserver.extension:gs-db2) before version 2.27.0. The vulnerability arises from unsafe deserialization of untrusted data, enabling an administrator to exploit a JNDI attack through a crafted DB2 JDBC URL. This can result in remote code execution on the affected system. The vulnerability is tracked under CWE-502 (Deserialization of Untrusted Data) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The CVSS v3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, required high privileges, no user interaction, and impacts confidentiality, integrity, and availability. The issue is resolved in GeoServer DB2 DataStore Extension version 2.27.0.
Potential Impact
Successful exploitation allows an attacker with administrator privileges to execute arbitrary code remotely on the affected GeoServer instance via a crafted DB2 JDBC URL. This compromises confidentiality, integrity, and availability of the system. The vulnerability requires high privileges to exploit and does not require user interaction.
Mitigation Recommendations
Upgrade the GeoServer DB2 DataStore Extension to version 2.27.0 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are documented. Since this is not a cloud service, patching the affected software version is necessary to mitigate the risk.
CVE-2025-27511: CWE-502: Deserialization of Untrusted Data in geoserver org.geoserver.extension:gs-db2
Description
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue.
CVSS v3.1
Score 7.2high
Affected software
pkg:maven/org.geoserver.extension/gs-db2Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-27511 affects the GeoServer DB2 DataStore Extension (org.geoserver.extension:gs-db2) before version 2.27.0. The vulnerability arises from unsafe deserialization of untrusted data, enabling an administrator to exploit a JNDI attack through a crafted DB2 JDBC URL. This can result in remote code execution on the affected system. The vulnerability is tracked under CWE-502 (Deserialization of Untrusted Data) and CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). The CVSS v3.1 base score is 7.2, indicating high severity with network attack vector, low attack complexity, required high privileges, no user interaction, and impacts confidentiality, integrity, and availability. The issue is resolved in GeoServer DB2 DataStore Extension version 2.27.0.
Potential Impact
Successful exploitation allows an attacker with administrator privileges to execute arbitrary code remotely on the affected GeoServer instance via a crafted DB2 JDBC URL. This compromises confidentiality, integrity, and availability of the system. The vulnerability requires high privileges to exploit and does not require user interaction.
Mitigation Recommendations
Upgrade the GeoServer DB2 DataStore Extension to version 2.27.0 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are documented. Since this is not a cloud service, patching the affected software version is necessary to mitigate the risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2025-02-26T18:11:52.306Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a340cacf198dc38c1059165
Added to database: 06/18/2026, 15:20:12 UTC
Last enriched: 07/16/2026, 10:58:40 UTC
Last updated: 08/02/2026, 07:17:53 UTC
Views: 64
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.