GeoServer 2.27.6 release is now available with downloads (bin, war, windows), along with docs and extensions.

This series has previously reached end-of-life, with this release issued to address an urgent bug or security vulnerability. Please apply this update as a mitigation measure only, and plan to upgrade to a stable or maintenance release of GeoServer.

GeoServer 2.27.6 is made in conjunction with GeoTools 33.6.

Thanks to Andrea Aime (GeoSolutions) and Jody Garnett (GeoCat) for making this release.

Security Considerations

This release addresses security vulnerabilities and is an urgent update for production systems.

  • GHSA-mqjf-5f49-2fjh Unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers (High)

    This releases includes the GeoTools 33.5 resolution of the above SQL Injection vulnerability which affects PostGIS 12 and up. Unfortunately our coordinated vulnerability disclosure policy was not followed in this case. This post will be updated with an official CVE number when one is available.

The use of the CVE system allows the GeoServer team to reach a wider audience than blog posts. See project security policy for more information on how security vulnerabilities are managed.

Release notes

Improvement:

  • GEOS-12080 style edit: check image loads
  • GEOS-12082 CoverageStore - quick fail for incorrect files
  • GEOS-12095 LDAP: conversion from group-member-username to user-search username

Task:

For the complete list see 2.27.6 release notes.

Community Updates

Community module development:

  • GEOS-12098 Rename JWT Header assembly so it is collected for nightly downloads
  • GEOS-12101 Workspace styles not persisted to disk after restore
  • GEOS-12129 Longitudinal profile positive altitude includes first elevation as ascent from zero

Community modules are shared as source code to encourage collaboration. If a topic being explored is of interest to you, please contact the module developer to offer assistance.

About GeoServer 2.27 Series

Additional information on GeoServer 2.27 series:

Release notes: ( 2.27.6 | 2.27.5 | 2.27.4 | 2.27.3 | 2.27.2 | 2.27.1 | 2.27.0 )