cve.bz

CVE-2026-42352

8.6 highEPSS 0.5%

High (8.6). EPSS 0.5% chance of exploitation in the next 30 days. Fixed in pygeoapi 0.23.3.

pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, OGC API process execution requests can use the subscriber object to requests to internal HTTP services. This issue has been patched in version 0.23.3.

Severity

CVSS 3.1

8.6 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS
0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
CWE
CWE-918
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-jgvc-94c8-3chcPyPIpygeoapi>=0.23.0 <0.23.30.23.3
PYSEC-2026-2986PyPIpygeoapi>=0.23.0 <0.23.30.23.3

References

Check your stackJSON