Every CVE Search/ Get API key

CVE-2026-76904

GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

9.8 CriticalPublic exploitFix available

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater jsonArrayContains(<column>, <pointer>, <value>) function writes <value> into generated SQL without escaping. Patches are available in versions 33.6, 34.5, and 33.6. No known workaround is available. To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

3.98%Up 3.5 points since Aug 22, 2026
90%50%10%1%

What each source reports

CVE List Score used 9.8

GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater jsonArrayContains(<column>, <pointer>, <value>) function writes <value> into generated SQL without escaping. Patches are available in versions 33.6, 34.5, and 33.6. No known workaround is available. To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.

Record
CVE-2026-76904
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
EUVDEUVD-2026-64133 9.8

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater jsonArrayContains(<column>, <pointer>, <value>) function writes <value> into generated SQL without escaping. Patches are available in versions 33.6, 34.5, and 33.6. No known workaround is available. To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.

Record
EUVD-2026-64133
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-mqjf-5f49-2fjh 9.8

GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

Summary

An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation:

  • jsonArrayContains function
    Requires PostGIS 12 or greater with a String or JSON field

For PostGIS 12 and greater jsonArrayContains(<column>, <pointer>, <value>) function writes <value> into generated SQL without escaping.

Patches

  • GeoTools 35.1
  • GeoTools 33.5
  • GeoTools 34.4

Mitigation

No mitigation is available:

  • To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.

Impact

This vulnerability can lead to execution of arbitrary SQL expressions in the database.

References

Record
GHSA-mqjf-5f49-2fjh
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
NVD 9.8

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater jsonArrayContains(<column>, <pointer>, <value>) function writes <value> into generated SQL without escaping. Patches are available in versions 33.6, 34.5, and 33.6. No known workaround is available. To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.

Record
CVE-2026-76904
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02
OSV 9.8

GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater jsonArrayContains(<column>, <pointer>, <value>) function writes <value> into generated SQL without escaping. Patches are available in versions 33.6, 34.5, and 33.6. No known workaround is available. To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.

Record
CVE-2026-76904
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-89
Updated
2026-11-04
OSVGHSA-mqjf-5f49-2fjh 9.8

GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

Summary

An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation:

  • jsonArrayContains function
    Requires PostGIS 12 or greater with a String or JSON field

For PostGIS 12 and greater jsonArrayContains(<column>, <pointer>, <value>) function writes <value> into generated SQL without escaping.

Patches

  • GeoTools 35.1
  • GeoTools 33.5
  • GeoTools 34.4

Mitigation

No mitigation is available:

  • To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.

Impact

This vulnerability can lead to execution of arbitrary SQL expressions in the database.

References

Record
GHSA-mqjf-5f49-2fjh
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-89
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.geotools.jdbc:gt-jdbc-postgis
Maven
 35.0 to 35.0
35.1
org.geotools.jdbc:gt-jdbc-postgis
Maven
 34.0 up to 34.5
34.5
org.geotools.jdbc:gt-jdbc-postgis
Maven
 30.5 up to 33.6
33.6
org.geotools.jdbc:gt-jdbc-postgis
Maven
 35.0 up to 35.1
35.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubYonLiud/CVE-2026-769042026-08-16
PoC in GitHubbickZero93/CVE-2026-769042026-08-26
NucleiGeoServer jsonArrayContains CQL Filter - SQL Injection

History

History
RecordedChangedSources
exploits, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-76904 is a critical vulnerability (CVSS 9.8) in Geotools, published August 21, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 3.98%, the 90th percentile. Fixed in org.geotools.jdbc:gt-jdbc-postgis 35.1.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open