Org.geotools.jdbc:gt jdbc postgis: GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers (CVE-2026-76904)
An unauthenticated SQL injection vulnerability exists in the GeoTools PostGIS DataStore implementation's jsonArrayContains filter function. This affects GeoTools versions prior to patched releases 35.1, 34.5, and 33.6. The vulnerability allows arbitrary SQL expressions to be executed in the database when using PostGIS 12 or greater with String or JSON fields. The vulnerability has a critical severity with a CVSS score of 9.8. No direct mitigation is available other than applying the official patches or limiting database connection rights.
AI Analysis
Technical Summary
The GeoTools library's PostGIS DataStore implementation contains an SQL injection vulnerability in the jsonArrayContains filter function. Specifically, for PostGIS 12 and later, the function jsonArrayContains(<column>, <pointer>, <value>) improperly writes the <value> parameter into generated SQL without escaping, allowing unauthenticated attackers to inject arbitrary SQL commands. This affects GeoTools versions >=30.5 <33.6, >=34.0 <34.5, >=35.0 <35.1, and =35.0. Official patches are available in GeoTools versions 33.6, 34.5, and 35.1. The vulnerability is tracked as CVE-2026-76904 and has a critical CVSS 3.1 score of 9.8.
Potential Impact
Successful exploitation allows unauthenticated attackers to execute arbitrary SQL expressions on the underlying PostGIS database, potentially leading to full compromise of database confidentiality, integrity, and availability. This can result in data leakage, data modification, or denial of service.
Mitigation Recommendations
Official patches are available in GeoTools versions 33.6, 34.5, and 35.1. Users should upgrade to these versions or later to remediate the vulnerability. No other mitigations are provided; however, limiting the database connection pool rights can reduce the potential impact of exploitation.
Org.geotools.jdbc:gt jdbc postgis: GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers (CVE-2026-76904)
Description
An unauthenticated SQL injection vulnerability exists in the GeoTools PostGIS DataStore implementation's jsonArrayContains filter function. This affects GeoTools versions prior to patched releases 35.1, 34.5, and 33.6. The vulnerability allows arbitrary SQL expressions to be executed in the database when using PostGIS 12 or greater with String or JSON fields. The vulnerability has a critical severity with a CVSS score of 9.8. No direct mitigation is available other than applying the official patches or limiting database connection rights.
CVSS v3.1
Score 9.8critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The GeoTools library's PostGIS DataStore implementation contains an SQL injection vulnerability in the jsonArrayContains filter function. Specifically, for PostGIS 12 and later, the function jsonArrayContains(<column>, <pointer>, <value>) improperly writes the <value> parameter into generated SQL without escaping, allowing unauthenticated attackers to inject arbitrary SQL commands. This affects GeoTools versions >=30.5 <33.6, >=34.0 <34.5, >=35.0 <35.1, and =35.0. Official patches are available in GeoTools versions 33.6, 34.5, and 35.1. The vulnerability is tracked as CVE-2026-76904 and has a critical CVSS 3.1 score of 9.8.
Potential Impact
Successful exploitation allows unauthenticated attackers to execute arbitrary SQL expressions on the underlying PostGIS database, potentially leading to full compromise of database confidentiality, integrity, and availability. This can result in data leakage, data modification, or denial of service.
Mitigation Recommendations
Official patches are available in GeoTools versions 33.6, 34.5, and 35.1. Users should upgrade to these versions or later to remediate the vulnerability. No other mitigations are provided; however, limiting the database connection pool rights can reduce the potential impact of exploitation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-mqjf-5f49-2fjh
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-76904"]
- Ecosystems
- ["Maven"]
- Database Specific Severity
- CRITICAL
- Cvss Version
- 3.1
Threat ID: 6a89a6e8acd9273b491520cd
Added to database: 08/22/2026, 13:40:56 UTC
Last enriched: 08/22/2026, 13:48:45 UTC
Last updated: 08/22/2026, 13:52:15 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.