Hi There,
We are running a Geoserver instance as part of a GeoNode 3.2 installation. I know we need to upgrade GeoNode, but in this case it is an issue onl related to Geoserver. In order to fix the CVE which was reported lately, we upgraded from 2.27.5 to 2.28.5, using the latest docker image from geonode/geoserver. With 100 000 published layers we have quite a big catalog, but until now it was working fine. Here are the major problems we discovered after upgrading to 2.28.5. The GeoServer is configured with XMX=7G.
- The startup took around 15 minutes (with version 2.27.5 it was 45 seconds)
- A WFS capabilities request for a single layer with a non-admin user (e.g. https://example.org/geoserver/geonode/layer-name/ows?service=WFS&version=1.1.1&request=GetCapabilities) leads to very high CPU load and high RAM usage and the request took more than 60 seconds and returned with a TimeOut error (in 2.27.5 < 1second)
- In general higher CPU load
I’m not sure, but may be this GeoFence issue is related at least to problem 2: [GEOS-12096] GeoFence: getSecurityFilter is too permissive by etj · Pull Request #9448 · geoserver/geoserver · GitHub . The fix of this issue is part of geofence 2.8.3, which is used in GeoServer 2.28.5
Note 1: The same issue occurs on a test instance with ~60 000 layers
Note 2: I fixed it by upgrading to 2.27.6, but soon this version will not be supported anymore.
Has anyone else experienced the same behavior after upgrading to GeoServer 2.28.x? If someone with a similarly large catalog could reproduce/test this, that would be very helpful.