Critical SQL Injection Vulnerability in GeoTools Affects Versions 30.5 to 33.5

## Overview GeoTools has a critical SQL injection vulnerability identified as CVE-2026-76904. This issue affects versions 30.5 through 33.5 of the library. The vulnerability arises when executing OGC Filters with the PostGIS DataStore implementation, specifically using the `jsonArrayContains` function. ## Technical Details The vulnerability requires PostGIS version 12 or greater that includes a String or JSON field. The `jsonArrayContains(<column>, <pointer>, <value>)` function improperly writes `<value>` into generated SQL without escaping it. This oversight can lead to SQL injection attacks, allowing unauthorized access to the database. ## Impact With a CVSS score of 9.8, this vulnerability is critical. Attackers could exploit it to execute arbitrary SQL commands, potentially leading to data breaches or loss of data integrity. Organizations using affected versions of GeoTools should assess their exposure and take immediate action. ## Mitigation Patches are available in GeoTools versions 33.6, 34.5, and 33.6. Organizations should upgrade to these versions as soon as possible. Additionally, to limit the scope of SQL injection attacks, configure the PostGIS connection pool with restricted rights. No known workarounds exist for this vulnerability.