GeoServer Blog

GeoServer 3.0.2 Release

Oct 19, 2026 • Jody Garnett

GeoServer 3.0.2 release is now available with downloads (bin, war, windows), along with docs and extensions.

This is a stable release of GeoServer recommended for production use. GeoServer 3.0.2 includes the latest GeoTools 35.2, GeoWebCache 2.0.2, along with mapfish-print-v2 2.5.2 and ImageN 0.9.3. There is a new GeoServer Cloud 3.0.2 release - representing the first time an updated GeoServer Cloud is made available on release day.

Thanks to Jody Garnett (GeoCat) for making this release, Andrea Aime (GeoSolutions) for testing, and Alessio Fabiani (GeoSolutions) Gabriel Roldan (Camptocamp) for the GeoServer Cloud release.

Security Considerations

This release addresses security vulnerabilities and is an important upgrade for production systems. Details about the fixes will be provided at the start of November.

See project security policy for more information on how security vulnerabilities are managed.

OGC API Maps 1.0

The OGC API Maps community module has been aligned with the final OGC API - Maps 1.0.0 standard.

  • Dataset map: Draw several collections into a single map, choosing and ordering them with the collections parameter. The map preview provides a palette to select collections, the first one drawn at the bottom.

    OGC API Maps dataset map preview

  • Filtering: Maps can be filtered using CQL2 Text, CQL2 JSON or ECQL, using the queryable attributes of each collection.

    OGC API Maps preview with filter

  • Conformance: Each optional conformance class (subsetting, scaling, background, crs, output formats, and more) can be enabled or disabled from the Services > Mapping settings page. Invalid parameters are now reported as a bad request rather than an internal error.

    OGC API Maps CQL2 conformance table

For more information see OGC API Maps in the user manual.

Thanks to Andrea Aime (GeoSolutions) for the OGC API - Maps development, and Jody Garnett (GeoCat) for the 3.0.x backport and improvements to the conformance table editor.

GeoFence for GeoServer 3

The GeoFence extensions are now available for GeoServer 3, completing Milestone 4: Integration of the GeoServer 3 crowdfunding campaign.

GeoFence has been updated to Jakarta EE, Spring Framework 7 and Hibernate 7:

  • The geofence plugin now communicates with a standalone GeoFence server using REST, as Spring remoting is no longer available.
  • The embedded geofence-server requires a PostgreSQL / PostGIS database, H2 is no longer supported.
  • The GeoFence admin page is found under the Security menu, showing the active engine and GeoFence services URL.

GeoFence admin page general settings

Existing GeoFence users should review the migration guide before upgrading, as the datasource configuration file has been renamed and the GeoFence authentication provider has been removed.

Thanks to Emanuele Tajariol (GeoSolutions) for this work, and to the GeoServer 3 crowdfunding sponsors for making it possible.

GeoServer 3 is supported by the following organisations:


Individual donations: Abhijit Gujar, Hennessy Becerra, Ivana Ivanova, John Bryant, Jason Horning, Jose Macchi, Peter Smythe, Sajjadul Islam, Sebastiano Meier, Stefan Overkamp.

FIPS

GeoServer 3.0.2 comes with a new FIPS community module. FIPS 140-3 is a United States government standard for cryptography modules, and many federal agencies and their suppliers are only allowed to run software that uses a validated one. In summary:

  • The FIPS module replaces the regular BouncyCastle library with the FIPS-validated one and runs it in approved-only mode.
  • Passwords are stored with AES-GCM.
  • A new FIPS tab under Server Status shows the overall cryptographic setup (see screenshot below).

FIPS status page

Keep in mind that the module works on Linux only and needs a new data directory: there is no migration tool yet for an existing one.

  • GEOS-12178 FIPS community module
  • GEOS-12123 Login failure in FIPS mode for GeoServerDigestPasswordEncoder

Thanks to Andrea Aime (GeoSolutions) for the FIPS module development.

Release notes

New Feature:

  • GEOS-12180 Add support for multi-layer tile caching (coalescing) in GWC

Improvement:

  • GEOS-10029 Use XML schema in applicationContext files
  • GEOS-12154 Improve URL validation in SLD processing
  • GEOS-12170 Centralize CRS list management across OGC APIs
  • GEOS-12176 Encrypt URL parameters with AES instead of DES
  • GEOS-12177 Do not hardcode algorithms in the security tests
  • GEOS-12179 Name the keystore file after its format, and refuse a mismatched one
  • GEOS-12183 CSS can trigger a bean loading circularity during startup
  • GEOS-12184 WCS Img coverage encoders subtly depend on gt-image
  • GEOS-12187 GeoJSON vector tiles are empty when the layer is meta-tiled
  • GEOS-12195 Refactoring of service resolution in Dispatcher
  • GEOS-12198 Support single-tenant Microsoft Entra ID authentication
  • GEOS-12199 Apply the catalog’s entity resolver consistently to stored query parsing
  • GEOS-12203 OIDC: let the identity provider assert the built-in “admin” account
  • GEOS-12205 Support GDAL 3.12+ new Raster Attribute Table data types
  • GEOS-12207 Layer preview feature info works poorly with long attribute names/values
  • GEOS-12208 RAT table view does not scroll any longer
  • GEOS-12209 Allow admins to request all layers from CSW endpoints
  • GEOS-12211 WPS: clean up GDAL configuration parsing
  • GEOS-12218 The print extension ships with a snapshot jar
  • GEOS-12231 Extension lookups take a global fair lock to read the JSONP setting
  • GEOS-12234 Report invalid connection settings when saving JDBC user/group, role and authentication services
  • GEOS-12235 Centralize remote IP resolution into a servlet filter
  • GEOS-12237 The style editor layer preview breaks with invalid chars in style names
  • GEOS-12238 CSW: Clearer exception in DirectDownload invalid requests
  • GEOS-12239 Read JDBC user and role property values as text
  • GEOS-12240 Clearer stored query error messages when query id is too long

Bug:

  • GEOS-12053 OGCAPI Features unable to disable core or enable draft / community standards
  • GEOS-12056 OGC API CQL conformance URIs are wrong
  • GEOS-12123 Login failure in FIPS mode for GeoServerDigestPasswordEncoder
  • GEOS-12143 Cannot create a tiled layer from the “tile caching” layer tab any longer
  • GEOS-12159 ReprojectingFeatureCollection throws ClassCastException reprojecting per-feature geometry between two Geographic 3D CRSs
  • GEOS-12172 Some testcases have overly verbose logging
  • GEOS-12174 Blob store creation fails under containerd — missing depends-on on gwcBlobStoreAggregator
  • GEOS-12193 “Encode coordinates measures” gives different geometries per GML version
  • GEOS-12200 GS3: Style Editor Color Helper layout broken
  • GEOS-12206 WMTS Multidim operations (DescribeDomains/GetHistogram/…) do not honor datasecurity
  • GEOS-12213 Changing the workspace of a WMS/WMTS cascaded store does not update its layers
  • GEOS-12216 Datadir loader fails on cross-workspace resource references
  • GEOS-12225 Session ID rotates on every request when the admin password is still the default
  • GEOS-12229 Backup and restore: after a job has been stopped, later backups and restores end STOPPED
  • GEOS-12230 Backup and restore: a full restore loses cascaded WMS/WMTS layers and workspace layer groups, and can empty its own archive

Task:

  • GEOS-11975 MapML extension / GeoServer 3.0 SNAPSHOT with MapML extension won’t start
  • GEOS-12160 Add URL checks to wps-download-plugin
  • GEOS-12171 Update to ImageN 0.9.3
  • GEOS-12181 Update gs-web-app to jetty.ee11 testing
  • GEOS-12186 Update to JakartaEE Servlet
  • GEOS-12188 GS3: jetty e11 de-dup warnings due to servlet-api compile scope
  • GEOS-12192 GeoFence: align to GeoServer3
  • GEOS-12241 MapFish Print 2.5.2 Update

For the complete list see 3.0.2 release notes.

Community Updates

Community module development:

  • GEOS-12161 Align OGC API Maps to v1.0.0
  • GEOS-12163 Expose filtering in OGC API Maps
  • GEOS-12167 Add dataset map support in OGC API Maps
  • GEOS-12178 FIPS community module
  • GEOS-12182 Support Azure SAS token authentication for COG stores
  • GEOS-12191 GS3: TilesServiceInfoImpl and ImagesServiceInfoImpl both configure tiles.xml
  • GEOS-12219 Remove the gwc-sqlite community module
  • GEOS-12221 WPS Longitudinal Profile: compute distances on the ground
  • GEOS-12222 JWT-Header: Improvements and documentation clarifications
  • GEOS-12236 Support conformance classes in OGC API Styles

Community modules are shared as source code to encourage collaboration. If a topic being explored is of interest to you, please contact the module developer to offer assistance.

About GeoServer 3.0 Series

Additional information on GeoServer 3.0 series:

Release notes: ( 3.0.2 | 3.0.1 | 3.0.0 )

Read More

GeoServer 2.28.6 Release

Oct 19, 2026 • Jody Garnett

GeoServer 2.28.6 release is now available with downloads (bin, war, windows), along with docs and extensions.

This is a maintenance release of GeoServer providing existing installations with minor updates and bug fixes. GeoServer 2.28.6 includes GeoTools 34.6 and GeoWebCache 1.28.6. GeoServer Cloud 2.28.6 is also available alongside today’s release.

Thanks to Peter Smythe (AfriGIS) for making this release, Andrea Aime (GeoSolutions) for testing, and Gabriel Roldan (Camptocamp) for the GeoServer Cloud release.

Security Considerations

This release addresses security vulnerabilities and is an important upgrade for production systems. Details about the fixes will be provided at the start of November.

See project security policy for more information on how security vulnerabilities are managed.

Release notes

New Feature:

  • GEOS-12180 Add support for multi-layer tile caching (coalescing) in GWC

Improvement:

  • GEOS-12099 GWC backup deadlock caused by DefaultTileLayerCatalog FileSystem
  • GEOS-12127 Fix flaky tests causing non-deterministic CI failures
  • GEOS-12139 GSIP 241 - GeoWebCache Security-Aware Tile Caching
  • GEOS-12154 Improve URL validation in SLD processing
  • GEOS-12183 CSS can trigger a bean loading circularity during startup
  • GEOS-12187 GeoJSON vector tiles are empty when the layer is meta-tiled
  • GEOS-12195 Refactoring of service resolution in Dispatcher
  • GEOS-12198 Support single-tenant Microsoft Entra ID authentication
  • GEOS-12199 Apply the catalog’s entity resolver consistently to stored query parsing
  • GEOS-12203 OIDC: let the identity provider assert the built-in “admin” account
  • GEOS-12205 Support GDAL 3.12+ new Raster Attribute Table data types
  • GEOS-12209 Allow admins to request all layers from CSW endpoints
  • GEOS-12211 WPS: clean up GDAL configuration parsing
  • GEOS-12218 The print extension ships with a snapshot jar
  • GEOS-12234 Report invalid connection settings when saving JDBC user/group, role and authentication services
  • GEOS-12235 Centralize remote IP resolution into a servlet filter
  • GEOS-12237 The style editor layer preview breaks with invalid chars in style names
  • GEOS-12238 CSW: Clearer exception in DirectDownload invalid requests
  • GEOS-12239 Read JDBC user and role property values as text.
  • GEOS-12240 Clearer stored query error messages when query id is too long

Bug:

  • GEOS-12065 WMS Layer REST PUT always returns 500 due to Collections.emptySet() in getRemoteStyleInfos()
  • GEOS-12100 Use SyncTaskExecutor to prevent deadlock in backup/restore tasklets
  • GEOS-12159 ReprojectingFeatureCollection throws ClassCastException reprojecting per-feature geometry between two Geographic 3D CRSs
  • GEOS-12193 “Encode coordinates measures” gives different geometries per GML version
  • GEOS-12206 WMTS Multidim operations (DescribeDomains/GetHistogram/…) do not honor datasecurity
  • GEOS-12213 Changing the workspace of a WMS/WMTS cascaded store does not update its layers
  • GEOS-12216 Datadir loader fails on cross-workspace resource references

Task:

  • GEOS-12136 IOTestUtils.createRandomDirectory() replacing mkdir call to more recent java.nio.files API
  • GEOS-12160 Add URL checks to wps-download-plugin

For the complete list see 2.28.6 release notes.

Community Updates

Community module development:

  • GEOS-12182 Support Azure SAS token authentication for COG stores
  • GEOS-12219 Remove the gwc-sqlite community module
  • GEOS-12221 WPS Longitudinal Profile: compute distances on the ground
  • GEOS-12222 JWT-Header: Improvements and documentation clarifications

Community modules are shared as source code to encourage collaboration. If a topic being explored is of interest to you, please contact the module developer to offer assistance.

About GeoServer 2.28 Series

Additional information on GeoServer 2.28 series:

Release notes: ( 2.28.6 | 2.28.5 | 2.28.4 | 2.28.3 | 2.28.2 | 2.28.1 | 2.28.0 )

Read More

GeoServer 2.27.7 Release

Oct 19, 2026 • Jody Garnett

GeoServer 2.27.7 release is now available with downloads (bin, war, windows), along with docs and extensions.

This series has previously reached end-of-life, with this release issued to address an urgent bug or security vulnerability. Please apply this update as a mitigation measure only, and plan to upgrade to a stable or maintenance release of GeoServer.

GeoServer 2.27.7 is made in conjunction with GeoTools 33.7.

Thanks to Peter Smythe (AfriGIS) for making this release, and Andrea Aime (GeoSolutions) for testing.

Security Considerations

This release addresses security vulnerabilities and is an important upgrade for production systems. Details about the fixes will be provided at the start of November.

It is worth repeating that the 2.27 series has reached end-of-life. While we understand that this is the last series supporting Java 8 please update to the supported 2.28 or 3.0 releases.

See project security policy for more information on how security vulnerabilities are managed.

Release notes

Improvement:

  • GEOS-12099 GWC backup deadlock caused by DefaultTileLayerCatalog FileSystem
  • GEOS-12127 Fix flaky tests causing non-deterministic CI failures
  • GEOS-12154 Improve URL validation in SLD processing
  • GEOS-12195 Refactoring of service resolution in Dispatcher
  • GEOS-12199 Apply the catalog’s entity resolver consistently to stored query parsing
  • GEOS-12211 WPS: clean up GDAL configuration parsing
  • GEOS-12234 Report invalid connection settings when saving JDBC user/group, role and authentication services
  • GEOS-12235 Centralize remote IP resolution into a servlet filter
  • GEOS-12237 The style editor layer preview breaks with invalid chars in style names
  • GEOS-12238 CSW: Clearer exception in DirectDownload invalid requests
  • GEOS-12239 Read JDBC user and role property values as text.
  • GEOS-12240 Clearer stored query error messages when query id is too long

Bug:

  • GEOS-12100 Use SyncTaskExecutor to prevent deadlock in backup/restore tasklets

Task:

  • GEOS-12136 IOTestUtils.createRandomDirectory() replacing mkdir call to more recent java.nio.files API
  • GEOS-12160 Add URL checks to wps-download-plugin

For the complete list see 2.27.7 release notes.

Community Updates

Community module development:

  • GEOS-12219 Remove the gwc-sqlite community module
  • GEOS-12222 JWT-Header: Improvements and documentation clarifications

Community modules are shared as source code to encourage collaboration. If a topic being explored is of interest to you, please contact the module developer to offer assistance.

About GeoServer 2.27 Series

Additional information on GeoServer 2.27 series:

Release notes: ( 2.27.7 | 2.27.6 | 2.27.5 | 2.27.4 | 2.27.3 | 2.27.2 | 2.27.1 | 2.27.0 )

Read More

GeoServer Security Update - September 2026

Sep 28, 2026 • Jody Garnett

This post provides a recap of the security advisories published over the summer of 2026, covering recently published Common Vulnerability and Exploits (CVE), along with a supply chain advisory affecting the GeoServer project. This activity has resulted in an update to our security policy covering AI-assisted vulnerability reports.

If you are responsible for a GeoServer instance, the short version is: please update to GeoServer 3.0.1, GeoServer 2.28.5, or GeoServer 2.27.6.

The GeoServer project follows a coordinated vulnerability disclosure policy: vulnerabilities are fixed for both stable and maintenance releases, prior to CVE details being published. The goal is to give everyone an opportunity to update prior to public disclosure.

August zero-day

In August GeoServer experienced a zero-day vulnerability (an exploit in the wild with no known fix). The problem had already been reported privately by several independent researchers, and a fix scheduled for the GeoServer 3.0.1 release.

The zero-day situation arose because a third party (unconnected to the project or to the researchers who had reported the issue) disclosed the vulnerability publicly on social media. The effect was immediately evident, with scans for this vulnerability detected within hours of the public social media post.

The speed of this response was remarkable and resulted in news coverage and an urgent call to update on our user forum. We would like to thank the reporter Ravie Lakshmanan who first notified project leadership via the Open Source Geospatial Foundation.

GeoServer 3.0.1, GeoServer 2.28.5, and GeoServer 2.27.6:

  • CVE-2026-76904 Unauthenticated PostGIS SQL injection in the jsonArrayContains filter function (Critical)

    This releases addresses the GeoTools CVE-2026-76904 SQL Injection vulnerability that: requires a Text or JSON column; affects PostGIS 12 and up.

This experience reaffirms the importance of following the coordinated vulnerability disclosure policy, and asking everyone to update when new releases are made available.

Previously published CVEs

The following CVEs were published on June 11, 2026, alongside the GeoServer 3.0.0 release.

GeoServer 2.27.3, and 2.26.4:

  • CVE-2025-58175 Server-Side Request Forgery (SSRF) Vulnerability in XML entity resolution (Medium)

  • CVE-2025-52465 Arbitrary file write vulnerability in Master Password Dump Page (High)

GeoServer 2.27.0:

  • CVE-2024-45747 Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates (High)

  • CVE-2025-27511 JNDI Vulnerability in DB2 Store Connection (High)

Supply chain advisory

Supply chain advisories have the possibility to affect the integrity of the software you download:

  • GHSA-cpc9-c4h3-2jwx GitHub Actions workflow in GeoServer Cloud (April 2026)

    A security researcher Aviv Donenfeld reported an issue in a geoserver-cloud repo GitHub actions workflow.

    While GeoServer uses GitHub for source code management and quality assurance workflows, such workflows are not used to build or publish download artifacts. A review was made to confirm all pull requests during the time of vulnerability were by trusted parties, secrets were rotated, and the workflow issue was addressed.

This was first time the project has worked with an infrastructure advisory like this. We have marked the advisory as “geoserver/geoserver-cloud (GitHub Actions)” as it does not correspond with a release of GeoServer, and as a result does not qualify for a CVE number.

It is important to note that no GeoServer releases were affected. GeoServer releases are made using a Jenkins build server publishing artifacts to both SourceForge and OSGeo infrastructure.

User Interface Search

AI-assisted vulnerability reports

Like many other software projects, we are experiencing a wave of vulnerability reports generated with AI assistance.

We have both established a general AI Policy, and updated our Security Policy, to acknowledge the use of these tools and provide guidance:

  • The human reporter is responsible for verifying the issue is real and reproducible before submitting.
  • Reports must include a working reproduction (code, request, or config) against a supported GeoServer series, not just a plausible-sounding description.
  • Reports that turn out to be hallucinated or unverifiable will be closed without further engagement.

Especially with AI reports, which are often very verbose, being on hand to clarify is greatly appreciated.

These reports can take quite some time to review, or even determine when such reports are duplicates. It also helps if you are in a position to test and verify fixes as they are addressed. Anything we can do to make the work of the geoserver-security team easier will be of assistance.

Q: How can I help?

If your organization depends on GeoServer, please consider sponsoring the project, or have your staff directly participate in geoserver-security work.

We are also looking to establish project membership for public institutions facing restrictions on sponsorship and participation.

Q: How often should I upgrade GeoServer?

GeoServer operates with a time-boxed release cycle, maintaining “stable” and “maintenance” releases, over the course of a year.

  • GeoServer 3.0.x is the current stable release
  • GeoServer 2.28.x is the current maintenance release

Please upgrade to a supported release at least once a year to continue receiving security fixes. See the Upgrading existing versions (User Guide) for guidance.

Q: How do I report a vulnerability?

Please see our security policy for instructions on reporting vulnerabilities privately using GitHub security advisories.

Read More

GeoServer 3.0.1 Release

Aug 14, 2026 • Jody Garnett

GeoServer 3.0.1 release is now available with downloads (bin, war, windows), along with docs and extensions.

This is a stable release of GeoServer recommended for production use. GeoServer 3.0.1 is made in conjunction with GeoTools 35.1, and GeoWebCache 2.0.1.

Thanks to Andrea Aime (GeoSolutions) and Jody Garnett (GeoCat) for making this release.

Security Considerations

This release addresses security vulnerabilities and is an urgent update for production systems.

  • CVE-2026-76904 Unauthenticated PostGIS SQL injection in the jsonArrayContains filter function (Critical)

    This releases addresses the GeoTools CVE-2026-76904 SQL Injection vulnerability that: requires a Text or JSON column; affects PostGIS 12 and up.

    We would like to thank those who reported the problem following our coordinated vulnerability disclosure policy; unfortunately the issue was subject to public disclosure prior to our intended release schedule.

The use of the CVE system allows the GeoServer team to reach a wider audience than blog posts. See project security policy for more information on how security vulnerabilities are managed.

Release notes

New Feature:

  • GEOS-12158 Keycloak Role Service for use alongside OIDC Extension

Improvement:

  • GEOS-12095 LDAP: conversion from group-member-username to user-search username
  • GEOS-12124 Make GWC seeder thread pool sizes configurable via gwc-gs.xml and environment variables
  • GEOS-12139 GSIP 241 - GeoWebCache Security-Aware Tile Caching
  • GEOS-12140 Improve CoverageAccessLimits’s RasterFilter masking on SecureGridCoverage2DReader reading
  • GEOS-12141 WMS nearest match machinery can issue queries that are guaranteed to return an empty result
  • GEOS-12151 Allow caching small images used by ImageMosaic in memory
  • GEOS-12154 Improve URL validation in SLD processing
  • GEOS-12169 Update MapML viewer to v0.18.0

Bug:

  • GEOS-11373 Geometry type mismatch in WFS 1.1.0
  • GEOS-12144 “application/vnd.ogc.fg+json” output format fails when requesting non-geographical datasets
  • GEOS-12145 Missing spatial filter in GeoFenceAccessManager SQL query when only CLIP is applied
  • GEOS-12146 Wrong CRS axis order used in SecuredFeatureSource when clipping features for WFS 2.0.0 requests
  • GEOS-12149 GeoServer WMTS capabilities put query parameters in the wrong place in generated URLs
  • GEOS-12165 GeoServer does not start when fileLockProvider is set: lock wait times out

Sub-task:

For the complete list see 3.0.1 release notes.

Community Updates

Community module development:

  • GEOS-12173 Remove the REST module profile from community modules as the module does not exist here

Community modules are shared as source code to encourage collaboration. If a topic being explored is of interest to you, please contact the module developer to offer assistance.

About GeoServer 3.0 Series

Additional information on GeoServer 3.0 series:

Release notes: ( 3.0.1 | 3.0.0 )

Read More

 Announcements

 Vulnerability

 Behind The Scenes

 Tutorials

 Developer notes