Security/vulnerability reports should not be submitted through GitHub tickets or the public mailing lists, but instead please send your report to the email address: mapserver-security nospam @ osgeo.org (remove the blanks and ‘nospam’).

Please follow the general guidelines for bug submissions, when describing the vulnerability (see https://mapserver.org/development/bugs.html).

The MapServer PSC (Project Steering Committee) will release patches for security vulnerabilities for the last release branch of the two most recent release series (such as 8.x, 7.x. 6.x, etc.) For example, once 8.0 is released, then only 8.0.x and 7.6.x will be supported/patched.

Currently, the following versions are supported: