CVE-2026-45104

MapServer is a system for developing web-based GIS applications. From 6.4.0 to before 8.6.3, msSLDParseUserStyle always calls _SLDApplyRuleValues(psRule, psLayer, 1); for any <Rule> carrying <ElseFilter/> — it assumes msSLDParseRule added one class. When the rule has no symbolizer (a structurally valid SLD), msSLDParseRule adds zero, and _SLDApplyRuleValues ends up indexing _class[-1], resulting in a NULL pointer dereference. A 200-byte well-formed SLD via the WMS SLD_BODY= parameter is enough to trigger this, no auth required. This vulnerability is fixed in 8.6.3.

• CWE-129
• CWE-476
• CWE-476

• https://github.com/MapServer/MapServer/security/advisories/GHSA-4h8g-378q-r75mExploit, Mitigation, Vendor Advisory

Published

May 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-45090Dalfox is a powerful open-source XSS scanner and utility foc…7.5
• CVE-2026-45091sealed-env is a cross-stack, zero-trust secret management li…9.1
• CVE-2026-4510A weakness has been identified in PbootCMS up to 3.2.12. Thi…4.3
• CVE-2026-45100OpenSIPS is a Session Initiation Protocol (SIP) server imple…9.1
• CVE-2026-45102OneUptime is an open-source monitoring and observability pla…9.9
• CVE-2026-45103OpenSIPS is a Session Initiation Protocol (SIP) server imple…7.5
• CVE-2026-45106Weblate is a web based localization tool. Prior to version 2…4.6
• CVE-2026-45108Himmelblau is an interoperability suite for Microsoft Azure …8.4
• CVE-2026-45109Next.js is a React framework for building full-stack web app…7.5
• CVE-2026-4511A security vulnerability has been detected in vanna-ai vanna…6.3
• CVE-2026-45112Allocation of Resources Without Limits or Throttling vulnera…7.5
• CVE-2026-4512The reCaptcha by WebDesignBy WordPress plugin before 2.0 doe…3.5