CVE-2026-76904
1 advisory.
Maven/org.geotools.jdbc:gt-jdbc-postgis CVE-2026-76904: critical 9.8, EPSS 3.98%
GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
Action: Upgrade org.geotools.jdbc:gt-jdbc-postgis to 33.6 (33.x), 34.5 (34.x) or 35.1 (35.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 35.0 | 35.1 | - |
| 34.0 | 34.5 | - |
| 30.5 | 33.6 | - |
Fixed versions
| 35.1 | 34.5 | 33.6 |
Sources
- osv: GHSA-mqjf-5f49-2fjh
- https://github.com/geotools/geotools/security/advisories/GHSA-mqjf-5f49-2fjh
- https://github.com/geotools/geotools/pull/5829
- https://github.com/geotools/geotools/commit/d821c4d321dd91c22e31fcd5b1ce676645da5176
- https://github.com/geotools/geotools
- https://github.com/geotools/geotools/releases/tag/33.6
- https://github.com/geotools/geotools/releases/tag/34.5
- https://github.com/geotools/geotools/releases/tag/35.1
- https://osgeo-org.atlassian.net/browse/GEOT-7589
- https://osgeo-org.atlassian.net/browse/GEOT-7958
- https://osgeo-org.atlassian.net/browse/GEOT-7959
CVE-2026-76904 · published · modified · JSON