CVE-2009-1176: OSGeo Mapserver

High severity, CVSS 10.0. EPSS: 4.1% chance of exploitation in the next 30 days.

mapserv.c in mapserv in MapServer 4.x before 4.10.4 and 5.x before 5.2.2 does not ensure that the string holding the id parameter ends in a '\0' character, which allows remote attackers to conduct buffer-overflow attacks or have unspecified other impact via a long id parameter in a query action.

Affected products

• OSGeo Mapserver: version 4.2.0 only; version 4.4.0 only; version 4.6.0 only; version 4.8.0 only; version 4.10.0 only; version 4.10.1 only; …
• Umn Mapserver: version 4.0 only

Published 2009-03-31. Last modified 2026-06-16.