Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-76904: GeoTools allows unauthenticated SQL injection via jsonArrayContains
CVE-2026-76904 · published 2 months ago
Summary
Versions of GeoTools from 30.5 up to but not including 33.6, 34.5, and later can let an attacker run arbitrary database commands when a specially crafted filter is used with PostGIS databases. This can expose or alter your geospatial data. Update GeoTools to the patched releases and configure the PostGIS connection with limited database rights.
What to do
- Update geotools org.geotools.jdbc:gt-jdbc-postgis to version 35.1.
- Update geotools org.geotools.jdbc:gt-jdbc-postgis to version 34.5.
- Update geotools org.geotools.jdbc:gt-jdbc-postgis to version 33.6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | geotools | geotools | = 35.0 |
| maven | geotools | org.geotools.jdbc:gt-jdbc-postgis |
35.0 >= 34.0, < 34.5 >= 30.5, < 33.6 Fix: upgrade to 35.1
|
Original advisory text
GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: `jsonArrayContains` function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater `jsonArrayContains(<column>, <pointer>, <value>)` function writes `<value>` into generated SQL without escaping. Patches are available in versions 33.6, 34.5, and 33.6. No known workaround is available. To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.
References
- https://osgeo-org.atlassian.net/browse/GEOT-7958 URL
- https://github.com/geotools/geotools/releases/tag/33.6 URL
- https://github.com/geotools/geotools/releases/tag/34.5 URL
- https://github.com/geotools/geotools/releases/tag/35.1 URL
- https://osgeo-org.atlassian.net/browse/GEOT-7589 URL
- https://github.com/advisories/GHSA-mqjf-5f49-2fjh
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76904... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-76904 Vendor Advisory
- https://osgeo-org.atlassian.net/browse/GEOT-7959 URL
- https://github.com/geotools/geotools/security/advisories/GHSA-mqjf-5f49-2fjh Vendor Advisory
- https://github.com/geotools/geotools/commit/d821c4d321dd91c22e31fcd5b1ce676645da... Patch
- https://github.com/geotools/geotools/pull/5829 Patch
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Type
CWE-89SQL Injection
Timeline
Published21 Aug 2026
Updated24 Oct 2026
First seen21 Aug 2026
Track software like this
Free during beta