CVE-2026-76904: GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
Summary
An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation:
jsonArrayContains function Requires PostGIS 12 or greater with a String or JSON field
For PostGIS 12 and greater jsonArrayContains(<column>, <pointer>, <value>) function writes <value> into generated SQL without escaping.
Patches
GeoTools 35.1 GeoTools 33.5 GeoTools 34.4
Mitigation
No mitigation is available:
To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.
Impact
This vulnerability can lead to execution of arbitrary SQL expressions in the database.
References
https://osgeo-org.atlassian.net/browse/GEOT-7958 https://osgeo-org.atlassian.net/browse/GEOT-7959 https://github.com/geotools/geotools/pull/5829 https://osgeo-org.atlassian.net/browse/GEOT-7589
Other sources
GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater jsonArrayContains(<column>, <pointer>, <value>) function writes <value> into generated SQL without escaping. Patches are available in versions 33.6, 34.5, and 33.6. No known workaround is available. To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.geotools.jdbc:gt-jdbc-postgisto a version that resolves this vulnerability.Fixed in 33.6 - Upgrade
Upgrade
maven/org.geotools.jdbc:gt-jdbc-postgisto a version that resolves this vulnerability.Fixed in 34.5 - Upgrade
Upgrade
maven/org.geotools.jdbc:gt-jdbc-postgisto a version that resolves this vulnerability.Fixed in 35.1 - Upgrade
Upgrade
GeoToolsto a version that resolves this vulnerability.Fixed in 33.6 - Upgrade
Upgrade
GeoToolsto a version that resolves this vulnerability.Fixed in 34.5 - Upgrade
Upgrade
GeoToolsto a version that resolves this vulnerability.Fixed in 35.1 - Compensating control
To limit scope of SQL Injection, configure the PostGIS connection pool with limited rights (least-privilege) for the GeoTools PostGIS DataStore connection.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the GeoTools PostGIS DataStore are affected when they execute OGC Filters containing the jsonArrayContains function against PostGIS 12 or later. The relevant field must be a String or JSON field.
Does exploitation require authentication or user interaction?
No. The vulnerability is rated with network attack vector, low attack complexity, no privileges required, and no user interaction required.
Which versions contain fixes?
Patches are available in GeoTools versions 33.6 and 34.5. Versions beginning with 30.5 and earlier than the listed fixed versions are affected under the stated PostGIS and filter conditions.
What can be done if an upgrade cannot happen immediately?
No known workaround is available. To reduce the impact of SQL injection, configure the PostGIS connection pool to use an account with limited database rights.