HIGH SeverityCVSS 3.18.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CVE-2026-42352

Last updated May 08, 2026 · Published May 08, 2026

Description

pygeoapi is a Python server implementation of the OGC API suite of standards. From version 0.23.0 to before version 0.23.3, OGC API process execution requests can use the subscriber object to requests to internal HTTP services. This issue has been patched in version 0.23.3.

Affected products

1 listed

geopython:pygeoapi

Mappings

CWE

CWE-918

CAPEC

None listed.

Research

Server-Side Request Forgery (SSRF)Explains how untrusted URLs can make servers reach internal or cloud metadata endpoints. Covers validation,…

Guides

Next.js SSRF ProtectionCommon SSRF paths in Next.js and how to block them.

Training

SSRF and Request ForgeryWhen your server makes requests on behalf of an attacker.

CVE-2026-42352

Description

Affected products

Mappings

Related