NCSC-2026-0304 [1.00] [M/H] ZeroDay Vulnerability Fixed in GeoTools by OpenGeo

GeoTools, a widely-used open source Java library for geospatial data, has released updates to fix a ZeroDay SQL injection vulnerability in the execution of OGC Filter functions when used with JDBCDataStore and other datastores. The mentioned vulnerability is a legacy vulnerability that has recently been found to not have been adequately fixed. The vulnerability allowed a malicious actor to execute arbitrary SQL code in the underlying database. The ZeroDay vulnerability is present in multiple OGC Filter functions that enable SQL injection when used with various datastore implementations such as PostGIS. This allows an attacker to inject malicious SQL code through these functions. The vulnerabilities are present in multiple versions of GeoTools. As partial mitigation, encode functions can be disabled and prepared statements can be enabled to reduce exposure. If the underlying database is running with elevated privileges, it is possible to execute arbitrary code on the server through this vulnerability, which could result in both unauthorized database manipulation and a potential system takeover. Researchers have received reports that malicious actors have drawn attention to the new ZeroDay and are observing an increase in scan and exploit traffic. At this time, there is no evidence of large-scale unauthorized access or actual abuse. For this new ZeroDay vulnerability, (yet) no CVE ID has been assigned.