GeoNetwork patched two formatter flaws that can be chained for unauthenticated remote code execution; no in-the-wild exploitation is reported.