CVE-2026-76904

Name of the Vulnerable Software and Affected Versions GeoTools versions 30.5 through 33.5 GeoTools version 34.4

Description An SQL injection flaw exists when executing OGC Filters with the PostGIS DataStore implementation. The issue occurs within the jsonArrayContains() function, which fails to escape the <value> parameter before inserting it into generated SQL queries. This exploitation requires the use of PostGIS version 12 or greater with a String or JSON field.

Recommendations Update GeoTools versions 30.5 through 33.5 to version 33.6. Update GeoTools version 34.4 to version 34.5. Configure the PostGIS connection pool with limited rights to restrict the scope of potential SQL injection.