CVE-2026-45104: MapServer Use-After-Free Vulnerability

CVE-2026-45104 Overview

CVE-2026-45104 is a NULL pointer dereference vulnerability in MapServer, an open-source platform for building web-based Geographic Information System (GIS) applications. The flaw resides in the msSLDParseUserStyle function, which mishandles Styled Layer Descriptor (SLD) rules that contain an <ElseFilter/> element but no symbolizer. Affected versions range from 6.4.0 to releases prior to 8.6.3. An unauthenticated attacker can send a 200-byte SLD payload through the Web Map Service (WMS) SLD_BODY= parameter to crash the server process [CWE-129].

Critical Impact
Unauthenticated remote attackers can trigger a denial-of-service condition against any exposed MapServer instance with a single crafted HTTP request.

Affected Products

MapServer versions 6.4.0 through 8.6.2
Web Map Service (WMS) endpoints accepting SLD_BODY parameters
GIS web applications built on vulnerable MapServer releases

Discovery Timeline

2026-05-27 - CVE-2026-45104 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45104

Vulnerability Analysis

The vulnerability stems from incorrect assumptions about class array population during SLD parsing. The function msSLDParseUserStyle unconditionally calls _SLDApplyRuleValues(psRule, psLayer, 1) for any <Rule> element containing <ElseFilter/>. This call assumes that msSLDParseRule has already added one class entry to the layer.

When a rule contains an <ElseFilter/> but no symbolizer, msSLDParseRule adds zero class entries. The subsequent code in _SLDApplyRuleValues then accesses _class[-1], dereferencing a NULL or invalid pointer. The process crashes, terminating the MapServer worker handling the request.

The input remains structurally valid SLD according to the specification, so standard XML schema validation does not block the payload. The bug is classified as improper validation of array index [CWE-129].

Root Cause

The root cause is a missing precondition check between msSLDParseRule and _SLDApplyRuleValues. The parser does not verify that a class was actually appended before computing the index numclasses - 1 to apply rule values. A symbolizer-less rule produces a negative index into the _class array.

Attack Vector

Attackers deliver a crafted SLD document through the WMS SLD_BODY query parameter over HTTP or HTTPS. No authentication, user interaction, or prior knowledge of the target configuration is required. A payload of approximately 200 bytes is sufficient to trigger the crash. Repeated requests result in sustained denial of service against the WMS endpoint.

Detection Methods for CVE-2026-45104

Indicators of Compromise

HTTP GET or POST requests to WMS endpoints containing SLD_BODY= parameters with <ElseFilter/> elements
Unexpected MapServer worker process terminations or segmentation faults in system logs
Web server error logs showing 500-level responses correlated with SLD-bearing requests
Repeated short-duration requests from a single source targeting WMS service URLs

Detection Strategies

Inspect WMS request parameters for SLD payloads containing <ElseFilter/> without accompanying symbolizer tags such as <PointSymbolizer>, <LineSymbolizer>, or <PolygonSymbolizer>
Monitor MapServer CGI or FastCGI process exit codes for abnormal terminations
Correlate web access logs with application crash events to identify exploitation attempts

Monitoring Recommendations

Enable verbose MapServer logging with MS_ERRORFILE to capture parser-level errors
Alert on spikes in WMS request volume or in 5xx HTTP responses from GIS services
Track process restart frequency for MapServer workers behind reverse proxies

How to Mitigate CVE-2026-45104

Immediate Actions Required

Upgrade MapServer to version 8.6.3 or later, which contains the official fix
Restrict access to WMS endpoints using network controls or authentication proxies where feasible
Deploy a web application firewall rule to block requests containing <ElseFilter/> in SLD_BODY parameters until patching completes

Patch Information

The MapServer project addressed this vulnerability in release 8.6.3. The fix adds a guard so _SLDApplyRuleValues is only invoked when msSLDParseRule has appended at least one class. Refer to the GitHub Security Advisory GHSA-4h8g-378q-r75m for full details.

Workarounds

Disable WMS SLD_BODY and SLD parameter support in MapServer configuration if dynamic styling is not required
Place MapServer behind a reverse proxy that strips or validates SLD payloads before forwarding
Implement rate limiting on WMS endpoints to reduce the impact of repeated crash attempts

bash

# Example WAF rule to block vulnerable SLD payloads (ModSecurity)
SecRule ARGS:SLD_BODY "@rx <ElseFilter\s*/>" \
    "id:1004510,phase:2,deny,status:403,\
    msg:'Potential CVE-2026-45104 MapServer SLD exploit attempt'"