CVE-2025-27511: GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection

June 11, 2026 (updated July 15, 2026)

Administrator can perform JNDI attack through specially crafted DB2 jdbc url leading to Remote Code Execution (RCE).

References

github.com/advisories/GHSA-g628-r368-6vh7
github.com/geoserver/geoserver/releases/tag/2.27.0
github.com/geoserver/geoserver/security/advisories/GHSA-g628-r368-6vh7
nvd.nist.gov/vuln/detail/CVE-2025-27511
nvd.nist.gov/vuln/detail/cve-2023-27867
osgeo-org.atlassian.net/browse/GEOT-7725

Code Behaviors & Features

Detect and mitigate CVE-2025-27511 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →