CVE-2026-76904
Received Received - Intake

SQL Injection in GeoTools with PostGIS DataStore

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description
GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: `jsonArrayContains` function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater `jsonArrayContains(<column>, <pointer>, <value>)` function writes `<value>` into generated SQL without escaping. Patches are available in versions 33.6, 34.5, and 33.6. No known workaround is available. To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-76904
EUVD
EUVD-2026-64133

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
geotools geotools to 33.6 (exc)
postgis postgis From 12 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an SQL Injection vulnerability in GeoTools, a Java library for geospatial data. It affects versions 30.5 to 33.5 and 34.4 when using PostGIS DataStore with OGC Filters. The jsonArrayContains function allows attackers to inject malicious SQL queries by manipulating input values, potentially leading to unauthorized data access or manipulation.

Detection Guidance

This vulnerability involves SQL injection in GeoTools when using OGC Filters with PostGIS DataStore. Detection requires checking GeoTools versions (30.5 to 33.5, 34.4, or 33.5) and PostGIS 12+ with String or JSON fields. Review application logs for suspicious SQL queries containing unescaped values in jsonArrayContains function calls.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary SQL commands on your database. This may result in unauthorized data access, data deletion, or modification of sensitive information. Systems using GeoTools with PostGIS 12+ and String/JSON fields are at risk.

Compliance Impact

This vulnerability could lead to violations of GDPR, HIPAA, and other regulations by enabling unauthorized access to personal or health data. Organizations may face legal penalties, reputational damage, and loss of compliance certifications if exploited.

Mitigation Strategies

Upgrade GeoTools to patched versions 33.6, 34.5, or 33.6. Configure PostGIS connection pool with limited database rights to reduce impact. If upgrading is not possible, disable or restrict access to OGC Filters with PostGIS DataStore until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76904. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart