{"action":"Upgrade org.geotools.jdbc:gt-jdbc-postgis to 33.6 (33.x), 34.5 (34.x) or 35.1 (35.x) or later.","affected":[{"fixed":"35.1","introduced":"35.0"},{"fixed":"34.5","introduced":"34.0"},{"fixed":"33.6","introduced":"30.5"}],"component":"org.geotools.jdbc:gt-jdbc-postgis","cve_ids":["CVE-2026-76904"],"ecosystem":"Maven","epss":0.03976,"exploited":false,"fixed_versions":["35.1","34.5","33.6"],"ghsa_id":"GHSA-mqjf-5f49-2fjh","id":"tcs_01M5N95K61F0ZR56CJ2EYZPMVE","modified_at":"2026-08-21T20:40:58.371279Z","published_at":"2026-08-21T20:25:41Z","references":["https://osv.dev/vulnerability/GHSA-mqjf-5f49-2fjh","https://github.com/geotools/geotools/security/advisories/GHSA-mqjf-5f49-2fjh","https://github.com/geotools/geotools/pull/5829","https://github.com/geotools/geotools/commit/d821c4d321dd91c22e31fcd5b1ce676645da5176","https://github.com/geotools/geotools","https://github.com/geotools/geotools/releases/tag/33.6","https://github.com/geotools/geotools/releases/tag/34.5","https://github.com/geotools/geotools/releases/tag/35.1","https://osgeo-org.atlassian.net/browse/GEOT-7589","https://osgeo-org.atlassian.net/browse/GEOT-7958","https://osgeo-org.atlassian.net/browse/GEOT-7959"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-mqjf-5f49-2fjh","url":"https://osv.dev/vulnerability/GHSA-mqjf-5f49-2fjh"}],"summary":"GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers"}