Critical severity · published Aug 21, 2026
CVE-2026-76904
GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
9.8
CVSS
4%
EPSS
No
On KEV
Description
GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: `jsonArrayContains` function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater `jsonArrayContains(<column>, <pointer>, <value>)` function writes `<value>` into generated SQL without escaping. Patches are available in versions 33.6, 34.5, and 33.6. No known workaround is available. To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)4.0% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
geotools · geotools
= 35.0; >= 34.0, < 34.5; >= 30.5, < 33.6 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-76904
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-76904
github.com
https://github.com/geotools/geotools/commit/d821c4d321dd91c22e31fcd5b1ce676645da5176
github.com
https://github.com/geotools/geotools/pull/5829
github.com
https://github.com/geotools/geotools/releases/tag/33.6
github.com
https://github.com/geotools/geotools/releases/tag/34.5
github.com
https://github.com/geotools/geotools/releases/tag/35.1
github.com
https://github.com/geotools/geotools/security/advisories/GHSA-mqjf-5f49-2fjh
More from geotools
9.8
CVE-2024-36401
Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver
9.8
CVE-2023-25158
GeoTools is an open source Java library that provides tools for geospatial data
9.1
CVE-2025-30220
GeoServer is an open source server that allows users to share and edit geospatial data
7.2
CVE-2022-24818
GeoTools is an open source Java library that provides tools for geospatial data