« Volver al listado

CVE-2026-76904

Estado: AplazadaCrítica (9.8)—

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: `jsonArrayContains` function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater `jsonArrayContains(<column>, <pointer>, <value>)` function writes `<value>` into generated SQL without escaping. Patches are available in versions 33.6, 34.5, and 33.6. No known workaround is available. To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

SQL injection en función jsonArrayContains de GeoTools/PostGIS sin sanitización. AV:N/AC:L/PR:N/UI:N permite explotación remota directa (T1190). Acceso a datos y manipulación de información confidencial en base de datos PostGIS.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningRestrict File and Directory PermissionsPrivileged Account ManagementRemote Data StorageNetwork SegmentationLimit Access to Resource Over Network

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Geotools — GeotoolsAIPostgis — PostgisAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-76904",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-76904",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-25T03:56:51.618521Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "geotools",
          "product": "geotools",
          "versions": [
            {
              "status": "affected",
              "version": "= 35.0"
            },
            {
              "status": "affected",
              "version": ">= 34.0, < 34.5"
            },
            {
              "status": "affected",
              "version": ">= 30.5, < 33.6"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-08-21T21:17:06.143",
  "references": [
    {
      "url": "https://github.com/geotools/geotools/commit/d821c4d321dd91c22e31fcd5b1ce676645da5176",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/geotools/geotools/pull/5829",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/geotools/geotools/releases/tag/33.6",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/geotools/geotools/releases/tag/34.5",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/geotools/geotools/releases/tag/35.1",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/geotools/geotools/security/advisories/GHSA-mqjf-5f49-2fjh",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://osgeo-org.atlassian.net/browse/GEOT-7589",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://osgeo-org.atlassian.net/browse/GEOT-7958",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://osgeo-org.atlassian.net/browse/GEOT-7959",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: `jsonArrayContains` function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater `jsonArrayContains(<column>, <pointer>, <value>)` function writes `<value>` into generated SQL without escaping. Patches are available in versions 33.6, 34.5, and 33.6. No known workaround is available. To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights."
    }
  ],
  "lastModified": "2026-09-09T21:06:39.057",
  "sourceIdentifier": "security-advisories@github.com"
}