CVE-2026-76904 in GeoTools
Summary
by MITRE • 08/22/2026
GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: `jsonArrayContains` function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater `jsonArrayContains(<column>, <pointer>, <value>)` function writes `<value>` into generated SQL without escaping. Patches are available in versions 33.6, 34.5, and 33.6. No known workaround is available. To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
GeoTools serves as a foundational open-source Java library designed to facilitate the processing and manipulation of geospatial data within enterprise applications. A critical security flaw has been identified in specific versions of this library, specifically those starting from version 30.5 up to but not including versions 33.6 and 34.5. This vulnerability manifests as a SQL Injection weakness that occurs when the application utilizes OGC Filters with the PostGIS DataStore implementation, particularly when invoking the jsonArrayContains function. The exploitability of this flaw is contingent upon specific environmental conditions, requiring the backend database to be running PostGIS version 12 or greater and involving columns defined as either String or JSON data types.
The technical root cause lies in how the library constructs SQL queries for the jsonArrayContains operation. In vulnerable versions, the function writes the input value directly into the generated SQL statement without performing any necessary escaping or sanitization of special characters. This lack of proper input validation allows an attacker to inject malicious SQL code through the JSON array values passed to the filter. Because PostGIS 12 and later versions support native JSON operations that are mapped directly to database functions, the library's failure to parameterize these inputs creates a direct pathway for command injection within the database layer. This represents a classic instance of improper neutralization of special elements used in an SQL command, commonly categorized under CWE-89: Improper Neutralization of Special Elements used in an SQL Command.
The operational impact of this vulnerability is severe, as it grants attackers the ability to execute arbitrary SQL commands on the underlying database server with the privileges assigned to the application's database connection account. Depending on the configuration and security posture of the PostGIS instance, this could lead to unauthorized data access, modification, or deletion. In worst-case scenarios where the database service runs with elevated system privileges, an attacker might leverage the injection to execute operating system commands, effectively achieving remote code execution. This compromises the confidentiality, integrity, and availability of geospatial datasets managed by the affected application. From a threat modeling perspective, this vulnerability aligns with ATT&CK technique T1059: Command and Scripting Interpreter, as it allows for the indirect execution of database-level commands that can escalate to broader system compromise if not properly isolated.
Mitigation strategies must be implemented immediately given the severity of the risk. The primary remediation is to upgrade GeoTools to a patched version, specifically 33.6 or later, which includes fixes for this input validation issue. For organizations unable to patch immediately due to dependency constraints, there are no known software workarounds that fully neutralize the vulnerability within the library itself. Therefore, defense-in-depth measures become critical. Administrators should configure the PostGIS connection pool with the principle of least privilege, ensuring that the database user account used by GeoTools has only the minimum permissions necessary for its operational functions. Restricting write access and disabling dangerous stored procedures can significantly limit the blast radius if an injection attempt is successful. Additionally, implementing Web Application Firewalls or input validation layers at the application boundary may help detect and block malformed SQL patterns before they reach the database layer, although this should be viewed as a compensating control rather than a primary fix.