SQL Injection Vulnerability in GeoTools Library Affects PostGIS Users
CVE-2026-76904
9.8CRITICAL
What is CVE-2026-76904?
GeoTools, an open-source Java library utilized for geospatial data processing, contains an SQL Injection vulnerability that arises in versions prior to 33.6 when executing OGC Filters with the PostGIS DataStore. Specifically, the function jsonArrayContains fails to properly escape input values when constructing SQL queries, allowing potential attackers to manipulate SQL commands. This vulnerability necessitates using PostGIS version 12 or greater. To mitigate risks, users are advised to upgrade to patched versions 33.6, 34.5, or higher. It's crucial to configure PostGIS connection pools with limited privileges to further minimize exposure.
Affected Version(s)
geotools = 35.0 = 35.0
geotools >= 34.0, < 34.5 < 34.0, 34.5
geotools >= 30.5, < 33.6 < 30.5, 33.6