Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
☕ Maven

CVE-2024-36404

CRITICAL

GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions

Also known asGHSA-w3pj-wh35-fq8w
Published
Jul 2, 2024
Updated
Apr 10, 2026
Affected
12 pkgs
Patched
12 / 12
Exploits
None indexed

EPSS Exploitation Probability

via FIRST.org ↗
90.7%probability of exploitation in next 30 days
Very High Risk100th percentile0.00%
90.2%90.8%91.4%91.9%90.9%90.7%Dec 25Apr 26Jun 26

EPSS (Exploit Prediction Scoring System) is a daily probability model maintained by FIRST.org. It estimates the likelihood a CVE will be exploited in production environments within the next 30 days, derived from real-world threat intelligence signals.

Blast Radius

12 pkgs affected
☕org.geotools:gt-app-schema☕org.geotools:gt-complex☕org.geotools.xsd:gt-xsd-core☕org.geotools:gt-app-schema☕org.geotools:gt-complex☕org.geotools.xsd:gt-xsd-core☕org.geotools:gt-app-schema☕org.geotools:gt-complex+4 more

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the gt-complex jar from one's application. As an example of the impact, application schema datastore would not function without the ability to use XPath expressions to query complex content. Alternatively, one may utilize a drop-in replacement GeoTools jar from SourceForge for versions 31.1, 30.3, 30.2, 29.2, 28.2, 27.5, 27.4, 26.7, 26.4, 25.2, and 24.0. These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications.

Affected Packages

12 total 12 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.geotools:gt-app-schema≥ 30.0&&< 30.430.4
☕Mavenorg.geotools:gt-complex≥ 30.0&&< 30.430.4
☕Mavenorg.geotools.xsd:gt-xsd-core≥ 30.0&&< 30.430.4
☕Mavenorg.geotools:gt-app-schema≥ 31.0&&< 31.231.2
☕Mavenorg.geotools:gt-complex≥ 31.0&&< 31.231.2
☕Mavenorg.geotools.xsd:gt-xsd-core≥ 31.0&&< 31.231.2

Frequently Asked Questions

GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the `gt-complex` jar from one's application. As an example of the impact, application schema `datastore` would not function without the ability to use XPath expressions to query complex content.
O3 Security · Impact-Aware SCA

Is CVE-2024-36404 in your stack?

O3 detects CVE-2024-36404 across Maven dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.

Scan my stack How O3 SCA works