CVE-2009-2281: OSGeo Mapserver

High severity, CVSS 10.0. EPSS: 5.9% chance of exploitation in the next 30 days.

Multiple heap-based buffer underflows in the readPostBody function in cgiutil.c in mapserv in MapServer 4.x through 4.10.4 and 5.x before 5.4.2 allow remote attackers to execute arbitrary code via (1) a crafted Content-Length HTTP header or (2) a large HTTP request, related to an integer overflow that triggers a heap-based buffer overflow. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-0840.

Affected products

• OSGeo Mapserver: version 4.2.0 only; version 4.4.0 only; version 4.6.0 only; version 4.8.0 only; version 4.10.0 only; version 4.10.1 only; …
• Umn Mapserver: version 4.0 only

Published 2009-10-23. Last modified 2026-06-16.