PatchSiren

GeoTools CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL GeoTools CVE published 2026-08-21

CVE-2026-76904

CVE-2026-76904 is a critical SQL injection vulnerability in GeoTools, a Java library for geospatial data, versions 30.5 and prior to 33.6, 34.5. The vulnerability is present when executing OGC Filters with PostGIS DataStore implementation using the `jsonArrayContains` function. This function writes user input into generated SQL without escaping, allowing attackers to inject malicious SQL code. The vulnera [truncated]