GeoTools SQL Injection Vulnerability: Early Warning and Mitigation Steps
- Severity
- HIGH
- Affected component
- org.geotools.jdbc:gt-jdbc-postgis (maven)
- Affected versions
- >= 35.0, < 35.1 or >= 35.0, <= 35.0 or >= 34.0, < 34.5 or >= 30.5, < 33.6
- Patched version
- 35.1, 33.5, 34.4
An SQL injection vulnerability has been found in GeoTools when executing OGC Filters with PostGIS DataStore implementation. This can lead to execution of arbitrary SQL expressions in the database.
What happened
An SQL injection vulnerability has been reported in GeoTools, specifically when executing OGC Filters with the PostGIS DataStore implementation. This vulnerability can potentially allow the execution of arbitrary SQL expressions in the database. The vulnerability affects the org.geotools.jdbc:gt-jdbc-postgis Maven package in certain version ranges.
The affected versions include org.geotools.jdbc:gt-jdbc-postgis >= 35.0, < 35.1 or >= 35.0, <= 35.0 or >= 34.0, < 34.5 or >= 30.5, < 33.6. The vulnerability is tracked under GHSA-MQJF-5F49-2FJH and CVE-2026-76904. It was first flagged on August 21, 2026.
The vulnerability appears to be exploitable through the jsonArrayContains filter function against PostGIS layers. It is under investigation and has not yet been exploited in the wild according to the current data.
What to do about it
- Upgrade to GeoTools 35.1, 33.5, or 34.4 to mitigate the risk.
- Configure the PostGIS connection pool with limited rights to reduce the potential impact of the vulnerability.
- Monitor the primary sources for updates on the vulnerability and any additional mitigation steps that may be recommended.
How 0Day would have caught this
org.geotools.jdbc:gt-jdbc-postgis is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using org.geotools.jdbc:gt-jdbc-postgis in versions >= 35.0, < 35.1 or >= 35.0, <= 35.0 or >= 34.0, < 34.5 or >= 30.5, < 33.6.
What should I do right now?
Upgrade to GeoTools 35.1, 33.5, or 34.4 and configure the PostGIS connection pool with limited rights.
Is this vulnerability currently being exploited?
According to the current data, this vulnerability has not yet been exploited in the wild.