GeoServer 3.0.1 / GeoServer 2.28.5 / GeoServer 2.27.6 Released

GeoServer GeoServer User
, ,
1

Hi all,

The GeoServer team is pleased to announce the following releases:

These releases are shared to address a security vulnerability and is an urgent update for production systems:

  • CVE-2026-76904 PostGIS SQL Injection int the jsonArrayContains Function (Critical)

    GeoServer is impaccted by a GeoTools CVE-2026-76904 SQL Injection vulnerability which affects PostGIS 12 and up. Unfortunately our coordinated vulnerability disclosure policy was not followed.

Each release is complete with docker image and windows installer. To find out more read the release announcements above.

Thanks to Andrea Aime (GeoSolutions) and Jody Garnett (GeoCat) for making these releases. We would also like to thank the hard work of geoserver-security team towards making these releases available promptly.

–

GeoServer Project Steering Committee

2

Hi @jive ,

For some reason the link for download this extensions is not working:
https://sourceforge.net/projects/geoserver/files/GeoServer/2.28.5/extensions/geoserver-2.28.5-oracle-plugin.zip/download

Is there any identified problem with that?

Thanks

3

The file exists on source forge:

  • https://sourceforge.net/projects/geoserver/files/GeoServer/2.28.5/extensions/geoserver-2.28.5-oracle-plugin.zip/download

You can try navigating to 2.28.5 folder and download from there?

It shows that it has been downloaded 112 times (113 times now that I checked the link).

4

Somehow my network was blocking only that plugin.
It’s working now.
Thank you