Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-76904: GeoTools lets attackers run SQL via jsonArrayContains
CVE-2026-76904 · published 13 days ago
Summary
The GeoTools library can insert untrusted data into database queries when using the jsonArrayContains function with PostGIS version 12 or newer. This could let an attacker execute any SQL commands on your database. Update GeoTools to the latest release (versions 33.5, 34.4, or 35.1) and consider restricting database permissions as an extra precaution.
What to do
- Update geotools org.geotools.jdbc:gt-jdbc-postgis to version 35.1.
- Update geotools org.geotools.jdbc:gt-jdbc-postgis to version 34.5.
- Update geotools org.geotools.jdbc:gt-jdbc-postgis to version 33.6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | geotools | geotools | = 35.0 |
| maven | geotools | org.geotools.jdbc:gt-jdbc-postgis |
35.0 >= 34.0, < 34.5 >= 30.5, < 33.6 Fix: upgrade to 35.1
|
Original advisory text
GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: `jsonArrayContains` function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater `jsonArrayContains(<column>, <pointer>, <value>)` function writes `<value>` into generated SQL without escaping. Patches are available in versions 33.6, 34.5, and 33.6. No known workaround is available. To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.
References
- https://github.com/geotools/geotools/releases/tag/33.6 x_refsource_MISC
- https://github.com/geotools/geotools/releases/tag/34.5 x_refsource_MISC
- https://github.com/geotools/geotools/releases/tag/35.1 x_refsource_MISC
- https://osgeo-org.atlassian.net/browse/GEOT-7589 x_refsource_MISC
- https://osgeo-org.atlassian.net/browse/GEOT-7958 x_refsource_MISC
- https://github.com/advisories/GHSA-mqjf-5f49-2fjh
- https://github.com/geotools/geotools/security/advisories/GHSA-mqjf-5f49-2fjh x_refsource_CONFIRM
- https://github.com/geotools/geotools/pull/5829 x_refsource_MISC
- https://github.com/geotools/geotools/commit/d821c4d321dd91c22e31fcd5b1ce676645da... x_refsource_MISC
- https://osgeo-org.atlassian.net/browse/GEOT-7959 x_refsource_MISC
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76904... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-76904 Vendor Advisory
Severity
9.8
Critical
CVSS 3.1: 9.8 (MITRE)
Exploitation
EPSS 2%
Type
CWE-89SQL Injection
Timeline
Published21 Aug 2026
Updated2 Sep 2026
First seen21 Aug 2026
Monitor software like this
Free during beta