Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.geotools.jdbc:gt-jdbc-postgis

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.8MavenAmendedPublished

    GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

    CVE-2026-76904 · GHSA-mqjf-5f49-2fjh

    Affected
    • Maven org.geotools.jdbc:gt-jdbc-postgis >= 35.0, <= 35.0; >= 34.0, < 34.5; >= 30.5, < 33.6
    Fixed in
    35.133.634.5· Vendor fix available
    Issue
    An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function Requires PostGIS 12 or greater with a String or JSON field For PostGIS 12 and greater jsonArrayContains(<column, <pointer, <value) function writes <value into generated SQL without escaping. Patches GeoTools 35.1 GeoTools 33.5 GeoTools 34.4 Mitigation No mitigation is available: To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights. Impact This vulnerability can lead to execution of arbitrary SQL expressions in the database. References https://osgeo-org.atlassian.net/browse/GEOT-7958 https://osgeo-org.atlassian.net/browse/GEOT-7959 https://github.com/geotools/geotools/pull/5829 https://osgeo-org.atlassian.net/browse/GEOT-7589

    Recommended action: Upgrade to 35.1, 34.5 or 33.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →