GitHub Advisoryadvisory · Maven

GHSA-mqjf-5f49-2fjh GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

CRITICAL Published 2026-08-21 Modified 2026-08-21 Official page ↗
Aliases
CVE-2026-76904
Ecosystem
Maven
Packages
org.geotools.jdbc:gt-jdbc-postgis
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2026-08-21

Affected packages

• Maven org.geotools.jdbc:gt-jdbc-postgis: >= 35.0, < 35.1 → fixed in 35.1 • Maven org.geotools.jdbc:gt-jdbc-postgis: >= 34.0, < 34.5 → fixed in 34.5 • Maven org.geotools.jdbc:gt-jdbc-postgis: >= 30.5, < 33.6 → fixed in 33.6

Description

Summary An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation: • `jsonArrayContains` function Requires PostGIS 12 or greater with a String or JSON field For PostGIS 12 and greater `jsonArrayContains(, , )` function writes `` into generated SQL without escaping. Patches • GeoTools 35.1 • GeoTools 33.5 • GeoTools 34.4 Mitigation No mitigation is available: • To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights. Impact This vulnerability can lead to execution of arbitrary SQL expressions in the database. References • https://osgeo-org.atlassian.net/browse/GEOT-7958 • https://osgeo-org.atlassian.net/browse/GEOT-7959 • https://github.com/geotools/geotools/pull/5829 • https://osgeo-org.atlassian.net/browse/GEOT-7589

Related

Alias · CVE (1)

  • CVE-2026-76904 GeoTools is an open source Java library that provides tools for geospatial data. vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References