GeoTools: SQL injection

GeoTools is an

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires PostGIS 12 or greater with a String or JSON…

Do this now

Upgrade GeoTools to 33.6, 34.5, or later, or avoid jsonArrayContains OGC filters on PostGIS.

First seen: 23 Oct 2026
Last update: 23 Oct 2026, 21:17 UTC
Identifiers: CVE-2026-76904
CVSS: 9.8
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## GeoTools: SQL injection
Severity: critical. Patch status: fix status unknown.
Affected: GeoTools is an
Ids: CVE-2026-76904

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires PostGIS 12 or greater with a String or JSON…

## Steps
1. Search the repo, its CI and infra config for GeoTools is an. If present, report the version in use and whether it's affected.
2. There is no fix yet. Until one ships: GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires PostGIS 12 or greater with a String or JSON…

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-76904") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://github.com/geotools/geotools/commit/d821c4d321dd91c22e31fcd5b1ce676645da5176 https://nvd.nist.gov/vuln/detail/CVE-2026-76904
https://pwned.coffee/i/geotools-sql-injection-cve-2026-76904

Timeline

23 Oct 2026, 21:17 UTC
Proof-of-concept code for CVE-2026-76904 is public on GitHub. Unverified, but expect scanning to follow.
23 Oct 2026
First reported.

Sources

Totalone very hot coffee