StackRadar

CVE-2024-36404

Critical

Advisory

Published 5 Feb 2025In the index since 8 Sept 2026
Severity
Critical
worst across findings
CVSS
9.8
base score, highest
EPSS
0.761
100th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
4
of 17,781 indexed, latest versions
Container images
11
deployed by those charts
Fix available
2 of 2
affected packages

GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions

Carried by container images the latest versions of 4 of 17,781 indexed charts deploy, on 11 images.

Affected packageAffected versionsFixed inImages
gt-complexmaven27-SNAPSHOT, 28.228.611
gt-xsd-coremaven27-SNAPSHOT, 28.228.611
OSV records
GHSA-w3pj-wh35-fq8w

Charts affected

4 by stars
ChartLatestAffected imagesRadar Score
geoserver-cloudcamptocamp20.0.55 of 11See more

geoserver-cloud camptocamp2 0.0.5

5 of the 11 container images this version deploys carry CVE-2024-36404.

Container imageDigestPackageFixed in
geoservercloud/geoserver-cloud-rest:1.0-RC399540eef78ad
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6
geoservercloud/geoserver-cloud-wcs:1.0-RC35c254c53a357
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6
geoservercloud/geoserver-cloud-webui:1.0-RC3c687b1cbc891
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6
geoservercloud/geoserver-cloud-wfs:1.0-RC35288f320cf36
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6
geoservercloud/geoserver-cloud-wms:1.0-RC3a30a60ac6cd0
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6

Open the chart page →

84,444
geoserverCloudcamptocamp20.0.65 of 11See more

geoserverCloud camptocamp2 0.0.6

5 of the 11 container images this version deploys carry CVE-2024-36404.

Container imageDigestPackageFixed in
geoservercloud/geoserver-cloud-rest:1.0-RC399540eef78ad
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6
geoservercloud/geoserver-cloud-wcs:1.0-RC35c254c53a357
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6
geoservercloud/geoserver-cloud-webui:1.0-RC3c687b1cbc891
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6
geoservercloud/geoserver-cloud-wfs:1.0-RC35288f320cf36
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6
geoservercloud/geoserver-cloud-wms:1.0-RC3a30a60ac6cd0
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6

Open the chart page →

84,444
geoservercamptocamp20.0.35 of 12See more

geoserver camptocamp2 0.0.3

5 of the 12 container images this version deploys carry CVE-2024-36404.

Container imageDigestPackageFixed in
geoservercloud/geoserver-cloud-rest:1.0-RC25dc0c93a1710
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6
geoservercloud/geoserver-cloud-wcs:1.0-RC247ae1bdb4bcc
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6
geoservercloud/geoserver-cloud-webui:1.0-RC228c3e5a8c5a3
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6
geoservercloud/geoserver-cloud-wfs:1.0-RC28c70ee06d5ab
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6
geoservercloud/geoserver-cloud-wms:1.0-RC242775ba6a4da
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6

Open the chart page →

88,335
geonetwork-k8sgeonetwork-k8sVerified publisher4.2.81 of 5See more

geonetwork-k8s geonetwork-k8s 4.2.8

1 of the 5 container images this version deploys carry CVE-2024-36404.

Container imageDigestPackageFixed in
jingking/geonetwork-hnap:4.2.843e74ab234e1
gt-complex@28.2
gt-xsd-core@28.2
28.6
28.6

Open the chart page →

34,754

Container images carrying it

11 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
geoservercloud/geoserver-cloud-rest:1.0-RC399540eef78ad
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6
2
geoservercloud/geoserver-cloud-wcs:1.0-RC35c254c53a357
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6
2
geoservercloud/geoserver-cloud-webui:1.0-RC3c687b1cbc891
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6
2
geoservercloud/geoserver-cloud-wfs:1.0-RC35288f320cf36
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6
2
geoservercloud/geoserver-cloud-wms:1.0-RC3a30a60ac6cd0
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6
2
geoservercloud/geoserver-cloud-rest:1.0-RC25dc0c93a1710
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6
1
geoservercloud/geoserver-cloud-wcs:1.0-RC247ae1bdb4bcc
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6
1
geoservercloud/geoserver-cloud-webui:1.0-RC228c3e5a8c5a3
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6
1
geoservercloud/geoserver-cloud-wfs:1.0-RC28c70ee06d5ab
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6
1
geoservercloud/geoserver-cloud-wms:1.0-RC242775ba6a4da
gt-complex@27-SNAPSHOT
gt-xsd-core@27-SNAPSHOT
28.6
28.6
1
jingking/geonetwork-hnap:4.2.843e74ab234e1
gt-complex@28.2
gt-xsd-core@28.2
28.6
28.6
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.