CVE-2026-33721

Description

A flaw was found in MapServer, a system for developing web-based Geographic Information System (GIS) applications. A remote, unauthenticated attacker can exploit a heap-buffer-overflow vulnerability by sending a specially crafted Styled Layer Descriptor (SLD) with an excessive number of Threshold elements. This can cause the MapServer process to crash, leading to a Denial of Service (DoS).

Statement

This is an Important denial of service vulnerability in MapServer, a system for developing web-based GIS applications. A remote, unauthenticated attacker can trigger a heap-buffer-overflow by sending a specially crafted Styled Layer Descriptor (SLD) with an excessive number of Threshold elements, causing the MapServer process to crash. This affects Red Hat Community Projects that include MapServer versions prior to 8.6.1.

Mitigation

Restrict network access to the MapServer instance to trusted clients only. Implement firewall rules to limit inbound connections to the MapServer service, ensuring that only authorized users or systems can submit Styled Layer Descriptor (SLD) requests. If MapServer functionality is not required, consider disabling or uninstalling the MapServer package to eliminate the attack surface. If a web application firewall (WAF) is in use, configure it to inspect and potentially filter overly large or malformed SLD requests.

Understanding the Weakness (CWE)

CWE-787

Integrity

Technical Impact: Modify Memory; Execute Unauthorized Code or Commands

Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.

Availability

Technical Impact: DoS: Crash, Exit, or Restart

Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.

Other

Technical Impact: Unexpected State

Subsequent write operations can produce undefined or unexpected results.

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.