CVE-2026-76904GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
Updated under an hour ago ()
Does this affect you?
It affects geotools. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: `jsonArrayContains` function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater `jsonArrayContains(<column>, <pointer>, <value>)` function writes `<value>` into generated SQL without escaping. Patches are available in versions 33.6, 34.5, and 33.6. No known workaround is available. To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-89
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Deferred
- Record last updated
- Aug 27, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
geotools geotools geotools:geotools (from the name) | = 35.0; from 34.0, < 34.5; from 30.5, < 33.6 | CNA record |
References
- https://github.com/geotools/geotools/security/advisories/GHSA-mqjf-5f49-2fjhx-refsource-confirm
- https://github.com/geotools/geotools/pull/5829x-refsource-misc
- https://github.com/geotools/geotools/commit/d821c4d321dd91c22e31fcd5b1ce676645da5176x-refsource-misc
- https://github.com/geotools/geotools/releases/tag/33.6x-refsource-misc
- https://github.com/geotools/geotools/releases/tag/34.5x-refsource-misc
- https://github.com/geotools/geotools/releases/tag/35.1x-refsource-misc
- https://osgeo-org.atlassian.net/browse/GEOT-7589x-refsource-misc
- https://osgeo-org.atlassian.net/browse/GEOT-7958x-refsource-misc
- https://osgeo-org.atlassian.net/browse/GEOT-7959x-refsource-misc
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.