Read the docs
TI-2026-53729 Aliases CVE-2026-76904GHSA-mqjf-5f49-2fjh

GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

Priority MEDIUM 56CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-89.

Summary

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: `jsonArrayContains` function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater `jsonArrayContains(<column>, <pointer>, <value>)` function writes `<value>` into generated SQL without escaping. Patches are available in versions 33.6, 34.5, and 33.6. No known workaround is available. To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03976 90th percentileScored 2026-11-07
Fix Fixed geotools (geotools): 34.5, 33.6org.geotools.jdbc:gt-jdbc-postgis (Maven): 35.1, 34.5, 33.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
geotoolsgeotools= 35.0; 34.0 to before 34.5; 30.5 to before 33.634.5, 33.6Patch availableCNA
—org.geotools.jdbc:gt-jdbc-postgis (Maven)35.0 to before 35.135.1Patch availableGHSA-mqjf-5f49-2fjh
—org.geotools.jdbc:gt-jdbc-postgis (Maven)34.0 to before 34.534.5Patch availableGHSA-mqjf-5f49-2fjh
—org.geotools.jdbc:gt-jdbc-postgis (Maven)30.5 to before 33.633.6Patch availableGHSA-mqjf-5f49-2fjh
  • geotools Vendorgeotools Affected = 35.0; 34.0 to before 34.5; 30.5 to before 33.6 Fixed in 34.5, 33.6 Patch available CNA
  • org.geotools.jdbc:gt-jdbc-postgis (Maven) Vendor— Affected 35.0 to before 35.1 Fixed in 35.1 Patch available GHSA-mqjf-5f49-2fjh
  • org.geotools.jdbc:gt-jdbc-postgis (Maven) Vendor— Affected 34.0 to before 34.5 Fixed in 34.5 Patch available GHSA-mqjf-5f49-2fjh
  • org.geotools.jdbc:gt-jdbc-postgis (Maven) Vendor— Affected 30.5 to before 33.6 Fixed in 33.6 Patch available GHSA-mqjf-5f49-2fjh

Remediation

  • Fix · CNA geotools (geotools) Fixed in 34.5, 33.6
  • Fix · GHSA-mqjf-5f49-2fjh org.geotools.jdbc:gt-jdbc-postgis (Maven) Fixed in 35.1 Advisory →
  • Fix · GHSA-mqjf-5f49-2fjh org.geotools.jdbc:gt-jdbc-postgis (Maven) Fixed in 34.5 Advisory →
  • Fix · GHSA-mqjf-5f49-2fjh org.geotools.jdbc:gt-jdbc-postgis (Maven) Fixed in 33.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-76904
  2. 2026-10-03 Alias added: GHSA-mqjf-5f49-2fjh
  3. 2026-10-05 EPSS moved to the 90th–95th percentile

References

Other 10

  • TI-2024-24187 Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-24190 GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions CVSS 3.1CRITICAL 9.8
  • TI-2025-21556 GeoTools, GeoServer, and GeoNetwork XML External Entity (XXE) Processing Vulnerability in XSD schema handling CVSS 3.1CRITICAL 9.9
  • TI-2023-10620 Unfiltered SQL Injection in Geotools CVSS 3.1CRITICAL 9.8
  • TI-2022-08631 Unchecked JNDI lookups in GeoTools CVSS 3.1HIGH 8.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences