Executive brief
MapServer, a popular open-source platform for publishing spatial data and interactive mapping applications, is vulnerable to a remote denial-of-service attack. An unauthenticated attacker can send a specially crafted, small mapping style request (SLD) to a MapServer web service, causing the application to crash. This can lead to service outages, particularly in environments where MapServer handles multiple requests simultaneously.
Technical details
A NULL pointer dereference exists in MapServer's SLD parsing logic within `src/mapogcsld.cpp`. The function `msSLDParseUserStyle` incorrectly assumes that any `<Rule>` containing an `<ElseFilter/>` will result in the creation of exactly one new class via `msSLDParseRule`. However, if the rule contains no symbolizers (which is structurally valid SLD), `msSLDParseRule` adds zero classes. Subsequent logic in `_SLDApplyRuleValues` then attempts to index `psLayer->_class` with a value of -1, causing a crash. This is reachable unauthenticated via the WMS `SLD_BODY` or `SLD` parameters, which are enabled by default. The vulnerability is fixed in version 8.6.3 by calculating the actual number of classes added rather than assuming a constant value.
Affected products
- MapServer MapServer 6.4.0 to 8.6.2
Timeline
- 2026-05-07: advisory: GitHub Security Advisory published
- 2026-05-27: disclosed: CVE published to NVD
- 2026-05-27: patched: Fixed in version 8.6.3