GeoServer 2.27.6 release is now available with downloads (bin, war, windows), along with docs and extensions.

This series has previously reached end-of-life, with this release issued to address an urgent bug or security vulnerability. Please apply this update as a mitigation measure only, and plan to upgrade to a stable or maintenance release of GeoServer.

GeoServer 2.27.6 is made in conjunction with GeoTools 33.6.

Thanks to Andrea Aime (GeoSolutions) and Jody Garnett (GeoCat) for making this release.

Security Considerations

This release addresses security vulnerabilities and is an urgent update for production systems.

  • CVE-2026-76904 Unauthenticated PostGIS SQL injection in the jsonArrayContains filter function (Critical)

    This releases addresses the GeoTools CVE-2026-76904 SQL Injection vulnerability that: requires a Text or JSON column; affects PostGIS 12 and up.

    We would like to thank those who reported the problem following our coordinated vulnerability disclosure policy; unfortunately the issue was subject to public disclosure prior to our intended release schedule.

The use of the CVE system allows the GeoServer team to reach a wider audience than blog posts. See project security policy for more information on how security vulnerabilities are managed.

Release notes

Improvement:

  • GEOS-12080 style edit: check image loads
  • GEOS-12082 CoverageStore - quick fail for incorrect files
  • GEOS-12095 LDAP: conversion from group-member-username to user-search username

Task:

For the complete list see 2.27.6 release notes.

Community Updates

Community module development:

  • GEOS-12098 Rename JWT Header assembly so it is collected for nightly downloads
  • GEOS-12101 Workspace styles not persisted to disk after restore
  • GEOS-12129 Longitudinal profile positive altitude includes first elevation as ascent from zero

Community modules are shared as source code to encourage collaboration. If a topic being explored is of interest to you, please contact the module developer to offer assistance.

About GeoServer 2.27 Series

Additional information on GeoServer 2.27 series:

Release notes: ( 2.27.6 | 2.27.5 | 2.27.4 | 2.27.3 | 2.27.2 | 2.27.1 | 2.27.0 )