p PatchFirst

CVE-2026-42352

CVE-2026-42352 · pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processes Subscriber

This page contains facts from public vulnerability sources. Check the original advisory before updating.

pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, OGC API process execution requests can use the subscriber object to requests to internal HTTP services. This issue has been patched in version 0.23.3.

CVSS 8.6 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: python

Affected products and versions

  • pygeoapi

    Versions
    • >= 0.23.0, < 0.23.3: Affected

    No fix published

  • pygeoapi PyPI

    Versions
    • 0.23.0
    • 0.23.1
    • 0.23.2
    Affected ranges
    • ECOSYSTEM: ≥ 0.23.0, < 0.23.3

    Update to 0.23.3

Original sources

Check your server →