CVE-2026-50126: Adaguc-server GeoJSON DoS Vulnerability

CVE-2026-50126 Overview

CVE-2026-50126 is a memory-safety vulnerability in Adaguc-server, an open source geographical information system used to visualize and share meteorological, climatological, and remote sensing data through Open Geospatial Consortium (OGC) standards. Versions prior to 7.2.2 crash when parsing a GeoJSON document whose geometry contains a malformed coordinate. The flaw affects four geometry branches: Polygon, LineString, MultiLineString, and MultiPolygon. An unauthenticated attacker can trigger the crash through a Web Map Service (WMS) request that references a crafted GeoJSON file exposed via the AutoResource feature.

Critical Impact
A crafted GeoJSON file reliably crashes the Adaguc-server backend process, producing a denial-of-service condition against unauthenticated WMS endpoints.

Affected Products

KNMI Adaguc-server versions prior to 7.2.2
Deployments serving configured GeoJSON datasets
Deployments exposing GeoJSON files through the AutoResource feature

Discovery Timeline

2026-08-18 - CVE-2026-50126 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-50126

Vulnerability Analysis

The vulnerability resides in the coordinate parser in adagucserverEC/CConvertGeoJSON.cpp. The parser indexes pt.u.array.values[0] and pt.u.array.values[1] and uses polygon.u.array.length as a loop bound. It performs neither JSON node type validation nor coordinate length validation before dereferencing these array entries.

A coordinate that is an empty array, a one-element array, a scalar, or null leads to an out-of-bounds heap read or a NULL pointer dereference [CWE-125]. The same unchecked pattern repeats across the Polygon, LineString, MultiLineString, and MultiPolygon geometry branches, expanding the attack surface across every geometry type Adaguc-server accepts.

Root Cause

The parser trusts the structure of the incoming GeoJSON document. It assumes every coordinate node is a two-element numeric array without checking the node type or the array length. Malformed nodes cause the process to dereference invalid memory.

Attack Vector

The vulnerable parser runs whenever the server processes a local GeoJSON file. That includes both configured GeoJSON datasets and GeoJSON files exposed through the AutoResource feature. An unauthenticated attacker can submit a WMS request referencing a crafted GeoJSON file to crash the backend process handling the request.

cpp

//                          CDBDebug("polygon: %d", polygon.u.array.length);
for (unsigned int i = 0; i < polygon.u.array.length; i++) {
  json_value pt = *polygon.u.array.values[i];
+ if (pt.u.array.values == nullptr || pt.u.array.length < 2) {
+   continue;
+ }
+
  json_value lo = *pt.u.array.values[0];
  json_value la = *pt.u.array.values[1];
  double lon = (double)lo;

Source: GitHub Commit 30dffde. The patch adds a null check and enforces a minimum coordinate length of two elements before dereferencing.

Detection Methods for CVE-2026-50126

Indicators of Compromise

Unexpected termination or segmentation faults in the Adaguc-server backend process during WMS request handling.
Repeated WMS requests referencing GeoJSON resources followed by 5xx responses or connection resets.
Core dumps referencing symbols within CConvertGeoJSON.cpp.

Detection Strategies

Monitor Adaguc-server process crashes correlated with inbound WMS requests that target GeoJSON AutoResource paths.
Inspect GeoJSON documents at ingest for coordinate nodes that are scalar, null, empty arrays, or arrays with fewer than two numeric elements.
Alert on repeated 5xx or gateway timeout responses from Adaguc-server WMS endpoints originating from a single source.

Monitoring Recommendations

Enable verbose logging for GeoJSON parsing paths and route logs to a centralized analytics pipeline.
Track backend process restart frequency; a spike suggests exploitation attempts.
Retain WMS request URLs and referenced resource paths to support post-incident forensic review.

How to Mitigate CVE-2026-50126

Immediate Actions Required

Upgrade Adaguc-server to version 7.2.2, which patches the coordinate parser in CConvertGeoJSON.cpp.
Audit all GeoJSON datasets and AutoResource-exposed GeoJSON files for untrusted or attacker-controlled content.
Restrict network access to WMS endpoints where feasible until the upgrade is complete.

Patch Information

Version 7.2.2 patches the vulnerability. The fix is tracked in GitHub Pull Request #710, applied in commit 30dffde, and released in Adaguc-server 7.2.2. Additional context is available in GitHub Security Advisory GHSA-mwgv-59vv-rp2m.

Workarounds

Disable the AutoResource feature if it is not required for production workloads.
Validate GeoJSON documents before serving them, rejecting any file with coordinate nodes that are not two-element numeric arrays.
Place Adaguc-server behind a reverse proxy that filters WMS requests referencing unexpected GeoJSON resource paths.

bash

# Upgrade to the patched release
git fetch --tags
git checkout 7.2.2
# Rebuild and restart the Adaguc-server backend
docker compose build adaguc-server
docker compose up -d adaguc-server