Stable Release

GeoServer 2.26.0

Released: October 14, 2024 • Branch: 2.26.x • JDK 11+ Required • Tomcat/Jetty 9.4+ Compatible

Release Overview

Version 2.26.0 focuses on enhanced OGC API compliance, improved vector tile rendering performance, and critical security hardening for production deployments. This release includes a redesigned WMTS tile caching backend, native support for Cloud Optimized GeoTIFF (COG) streaming, and significant improvements to the REST API for automated configuration management.

⚠️ Important for Upgrades Users migrating from 2.22.x or earlier are strongly advised to upgrade to 2.25.x first before moving to 2.26.0. Direct multi-version jumps may require manual database migrations for workspace catalogs.

Downloads & Checksums

Official binaries are signed and verified. Always validate SHA-256 checksums before deployment.

📦 WAR Archive (248 MB) 🗜️ ZIP Distribution 🐳 Docker Image 📄 SHA256 Checksums 
sha256sum geoserver-2.26.0-war.zip
8f3a9c2e... geoserver-2.26.0-war.zip

New Features

Feature Performance

OGC API - Features Part 1 & 2 Compliance

Full implementation of OGC API - Features End-to-End testing suite. Includes `/conformance`, `/collections`, and `/items` endpoints with native GeoJSON and application/geo+json responses.

Feature

Native COG Streaming & Pyramids

Direct reading of Cloud Optimized GeoTIFFs without pre-processing. Supports overviews, compression formats (DEFLATE, ZSTD, JPEG), and region-of-interest fetching via HTTP range requests.

Feature Security

OAuth 2.0 / OpenID Connect Integration

Built-in support for modern identity providers. Replaces legacy basic auth in security policies. Includes token introspection and JWT validation middleware.

Enhancements

  • Perf WMTS Tile Caching: Switched to RocksDB-backed cache for 3x faster tile retrieval under high concurrency (GS-18421)
  • Perf SLD/SLD-1.1: Optimized symbolizer rendering pipeline, reducing CPU overhead by ~18% for complex multi-polygon layers (GS-18390)
  • UX Web Admin Interface: Added dark mode toggle, improved resource browser tree search, and real-time style validation preview
  • API REST Config: New `/rendering` endpoint for runtime style injection without service restart (GS-18455)
  • Data PostGIS/JDBC: Added native support for `GEOMETRYCOLLECTION` type filtering and improved connection pool monitoring metrics

Bug Fixes

  • Fix Fixed WFS 2.0 `Transaction` rollback failure when nested geometries exceed max feature size (GS-18310)
  • Fix Resolved memory leak in GeoWebCache when processing infinite extent raster layers (GS-18355)
  • Fix Corrected EPSG:3857 bounding box clipping artifacts in WMS GetMap requests (GS-18402)
  • Fix Fixed REST API `404` on workspace deletion when referencing shared data stores (GS-18411)
  • Fix Addressed XSS vulnerability in style parameter input fields (CVE-2024-XXXXX)

Breaking Changes & Deprecations

🔴 Configuration Changes The `global.xml` security configuration schema has been updated. Legacy `filterChainProxy` definitions must be migrated to the new `security.xml` format. Automated migration script provided in `bin/migrate-security-2.26.sh`.
  • Break Dropped support for JDK 8 and 9. Minimum requirement is now JDK 11 LTS (or 17/21)
  • Break Removed deprecated `GeoServer` servlet context parameter `USE_JAI_IMAGEREAD`. Use `ImageIO` instead.
  • Deprecate WMTS 1.0.0 legacy XML capabilities response is deprecated. Migrate to OGC API - Tiles where possible.

Upgrade Instructions

  1. Backup your `` and `/webapps/geoserver` directory.
  2. Run the security migration script if upgrading from <2.24:
    ./bin/migrate-security-2.26.sh --input global.xml --output security.xml
  3. Replace the existing WAR file or ZIP contents with 2.26.0 binaries.
  4. Verify JDK version: `java -version` must output `11.0+`
  5. Restart your servlet container. Monitor `stdout` for `WARN` or `ERROR` during initialization.
  6. Run the built-in configuration validator via Web Admin > Status > Configuration.
💡 Pro Tip For zero-downtime upgrades, deploy the new version under a separate context path first, validate all OGC endpoints, then swap the live routing/load balancer target.

Known Issues

  • High-resolution WMS requests (>4000px) may trigger `OutOfMemoryError` if `MaxMemoryCacheSize` is not tuned. Increase JVM heap or enable `JAI_IMAGEIO` memory limits.
  • PostGIS 3.3+ native raster drivers occasionally fail on compressed out-of-db raster types. Workaround: enable `rtpostgis` extension explicitly in catalog.
  • REST API rate limiting defaults to 100 req/min. Adjust via `restApiThrottle` in `global.xml`.

Credits & Contributors

This release was made possible by 84 contributors across 12 organizations. Special thanks to the OGC Standards Committee, Tomcat/Jetty maintainers, and the GeoServer community for QA testing and issue triage.

Full contribution logs and pull request mappings are available on the GitHub Release Page.