SQL Injection Vulnerability in GeoTools Library Affects PostGIS Users
CVE-2026-76904

9.8CRITICAL

Key Information:

Vendor

Geotools

Status
Geotools
Vendor
CVE Published:
21 August 2026

What is CVE-2026-76904?

CVE-2026-76904 is a vulnerability identified in the GeoTools library, a widely-used open-source Java library designed for geospatial data processing. Specifically, this vulnerability arises from an SQL injection flaw within the implementation of OGC Filters when interacting with the PostGIS DataStore, particularly involving the jsonArrayContains function. Introduced in versions up to 33.6, and 34.5, the issue manifests when the library fails to properly escape input values in SQL queries, thereby permitting arbitrary SQL command injection. This creates a substantial risk for organizations relying on GeoTools for geospatial data manipulation, as attackers could exploit this vulnerability to access or manipulate sensitive data in their database, potentially leading to unauthorized disclosure or data corruption.

Potential impact of CVE-2026-76904

  1. Data Breaches: The SQL injection vulnerability can allow attackers to execute unauthorized SQL queries, leading to potential exposure of sensitive data stored within the PostGIS database. This can significantly impact an organization’s confidentiality and compliance with data protection regulations.

  2. Data Corruption: An attacker capable of injecting SQL commands can modify, delete, or corrupt existing data. This compromise can disrupt services and lead to significant data integrity issues, which can be costly to rectify.

  3. Denial of Service: Exploitation of this vulnerability can result in denial of service scenarios, where an attacker may manipulate database queries to create heavy loads on the server, affecting the availability of the services relying on the GeoTools library for geospatial data processing.

Affected Version(s)

geotools = 35.0 = 35.0

geotools >= 34.0, < 34.5 < 34.0, 34.5

geotools >= 30.5, < 33.6 < 30.5, 33.6

References

https://github.com/geotools/geotools/security/advisories/...
x_refsource_CONFIRM
https://github.com/geotools/geotools/pull/5829
x_refsource_MISC
https://github.com/geotools/geotools/commit/d821c4d321dd9...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.