CVE-2026-45104 MapServer: NULL pointer dereference in SLD `<ElseFilter>` rule parsing reachable via WMS `SLD_BODY`

High 7.5 Published 27 May 2026 Updated 1 Jun 2026

Unauthenticated attackers can cause a denial of service in MapServer by sending a malformed SLD_BODY parameter to the WMS interface.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-45104?

CVE-2026-45104 is a high-severity vulnerability in MapServer, published on 27 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls _SLDApplyRuleValues(psRule, psLayer, 1); for any <Rule> carrying <ElseFilter/> — it assumes msSLDParseRule added one class. When the rule has no symbolizer (a structurally valid SLD), msSLDParseRule adds zero, and _SLDApplyRuleValues ends up indexing _class[-1], resulting in a NULL pointer dereference. A 200-byte well-formed SLD via the WMS SLD_BODY= parameter is enough to trigger this, no auth required. This vulnerability is fixed in 8.6.3.

Weakness: CWE-476, CWE-129

Which versions are affected by CVE-2026-45104?

It affects 1 product.

Products include Osgeo Mapserver.

How do I fix CVE-2026-45104?

Upgrade to a fixed version.

Is CVE-2026-45104 being exploited?

There is no known exploitation of CVE-2026-45104 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-45104, GHSA-4h8g-378q-r75m, UBUNTU-CVE-2026-45104.