{"id":"CVE-2026-76904","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-76904","summary":"GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers","details":"### Summary\n\nAn SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation:\n\n* `jsonArrayContains` function  \n    Requires PostGIS 12 or greater with a String or JSON field\n\nFor PostGIS 12 and greater `jsonArrayContains(<column>, <pointer>, <value>)` function writes `<value>` into generated SQL without escaping.\n\n### Patches\n\n* GeoTools 35.1\n* GeoTools 33.5\n* GeoTools 34.4\n\n### Mitigation\n\nNo mitigation is available:\n\n* To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.\n\n### Impact\n\nThis vulnerability can lead to execution of arbitrary SQL expressions in the database.\n\n### References\n\n* https://osgeo-org.atlassian.net/browse/GEOT-7958\n* https://osgeo-org.atlassian.net/browse/GEOT-7959\n* https://github.com/geotools/geotools/pull/5829\n* https://osgeo-org.atlassian.net/browse/GEOT-7589","published":"2026-08-21T20:25:41Z","modified":"2026-08-21T20:30:08.056185568Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Maven","name":"org.geotools.jdbc:gt-jdbc-postgis","fixedVersion":"35.1"},{"ecosystem":"Maven","name":"org.geotools.jdbc:gt-jdbc-postgis","fixedVersion":"34.5"},{"ecosystem":"Maven","name":"org.geotools.jdbc:gt-jdbc-postgis","fixedVersion":"33.6"}],"fix":{"url":"https://github.com/geotools/geotools/pull/5829","label":"geotools/geotools#5829"},"references":[{"type":"WEB","url":"https://github.com/geotools/geotools/security/advisories/GHSA-mqjf-5f49-2fjh"},{"type":"WEB","url":"https://github.com/geotools/geotools/pull/5829"},{"type":"WEB","url":"https://github.com/geotools/geotools/commit/d821c4d321dd91c22e31fcd5b1ce676645da5176"},{"type":"PACKAGE","url":"https://github.com/geotools/geotools"},{"type":"WEB","url":"https://github.com/geotools/geotools/releases/tag/33.6"},{"type":"WEB","url":"https://github.com/geotools/geotools/releases/tag/34.5"},{"type":"WEB","url":"https://github.com/geotools/geotools/releases/tag/35.1"},{"type":"WEB","url":"https://osgeo-org.atlassian.net/browse/GEOT-7589"},{"type":"WEB","url":"https://osgeo-org.atlassian.net/browse/GEOT-7958"},{"type":"WEB","url":"https://osgeo-org.atlassian.net/browse/GEOT-7959"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-21T20:30:08.056185568Z"}}