CVE-2026-76904: GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
Summary An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function Requires PostGIS 12 or greater with a String or JSON field For PostGIS 12 and greater jsonArrayContains( , , ) function writes into generated SQL without escaping.
Published Aug 21, 2026
Affected packages
org.geotools.jdbc:gt-jdbc-postgis
- Ecosystem
- Maven
- Affected
- = 35.0
- Fixed in
- 35.1
- Check
mvn dependency:tree -Dincludes=org.geotools.jdbc:gt-jdbc-postgis
org.geotools.jdbc:gt-jdbc-postgis
- Ecosystem
- Maven
- Affected
- >= 34.0, < 34.5
- Fixed in
- 34.5
- Check
mvn dependency:tree -Dincludes=org.geotools.jdbc:gt-jdbc-postgis
org.geotools.jdbc:gt-jdbc-postgis
- Ecosystem
- Maven
- Affected
- >= 30.5, < 33.6
- Fixed in
- 33.6
- Check
mvn dependency:tree -Dincludes=org.geotools.jdbc:gt-jdbc-postgis
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Summary
An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation:
jsonArrayContainsfunction Requires PostGIS 12 or greater with a String or JSON field
For PostGIS 12 and greater jsonArrayContains(<column>, <pointer>, <value>) function writes <value> into generated SQL without escaping.
Patches
- GeoTools 35.1
- GeoTools 33.5
- GeoTools 34.4
Mitigation
No mitigation is available:
- To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.
Impact
This vulnerability can lead to execution of arbitrary SQL expressions in the database.
References
- https://osgeo-org.atlassian.net/browse/GEOT-7958
- https://osgeo-org.atlassian.net/browse/GEOT-7959
- https://github.com/geotools/geotools/pull/5829
- https://osgeo-org.atlassian.net/browse/GEOT-7589
Credited to qquang, mrlihd, PhilipPhil, Quikko, jodygarnett, h1ei1, 4ra1n.
References
- https://github.com/geotools/geotools/security/advisories/GHSA-mqjf-5f49-2fjh
- https://github.com/geotools/geotools/pull/5829
- https://github.com/geotools/geotools/commit/d821c4d321dd91c22e31fcd5b1ce676645da5176
- https://github.com/geotools/geotools/releases/tag/33.6
- https://github.com/geotools/geotools/releases/tag/34.5
- https://github.com/geotools/geotools/releases/tag/35.1
- https://osgeo-org.atlassian.net/browse/GEOT-7589
- https://osgeo-org.atlassian.net/browse/GEOT-7958
- https://osgeo-org.atlassian.net/browse/GEOT-7959
- https://github.com/advisories/GHSA-mqjf-5f49-2fjh
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology