{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/geotools/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["GeoTools"],"_cs_severities":["critical"],"_cs_tags":["sql-injection","java","geotools","critical-patch"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe open-source GeoTools Java library, widely used for geospatial data processing and visualization, contains a critical SQL injection vulnerability (CVSS 9.8). This vulnerability allows unauthenticated attackers to supply malicious input that is executed as part of database queries performed by the library. Depending on the database service permissions, this could result in unauthorized data access, modification, or deletion. In scenarios where the database service runs with elevated privileges, it may lead to full system compromise. The vulnerability is currently being actively scanned by malicious actors, though large-scale exploitation has not yet been reported. Patches are available in versions 33.6, 34.5, and 35.1. Defenders should prioritize auditing systems that utilize GeoTools and apply the recommended version updates immediately.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows attackers to gain unauthorized access to sensitive geospatial data. The potential for server-wide compromise poses significant risks, including data breaches, loss of data integrity, and prolonged service disruption. The threat is elevated due to active scanning activity in the wild.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate all instances of GeoTools to versions 33.6, 34.5, or 35.1 immediately to remediate the vulnerability.\u003c/li\u003e\n\u003cli\u003eAudit application inventory to identify systems running vulnerable versions of GeoTools.\u003c/li\u003e\n\u003cli\u003eReview database service permissions; ensure the database account used by the GeoTools-dependent application follows the principle of least privilege to mitigate the impact of potential command execution.\u003c/li\u003e\n\u003cli\u003eMonitor application logs for abnormal database query patterns, such as unexpected SQL syntax characters (e.g., ;, --, OR 1=1) originating from external user inputs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-18T13:58:00Z","date_published":"2026-08-18T13:58:00Z","id":"https://feed.craftedsignal.io/briefs/2026-08-geotools-sql-injection/","summary":"A critical SQL injection vulnerability in the GeoTools Java library allows unauthenticated remote attackers to execute arbitrary database commands, leading to potential data exfiltration or full server compromise.","title":"Critical SQL Injection Vulnerability in GeoTools Library","url":"https://feed.craftedsignal.io/briefs/2026-08-geotools-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - GeoTools","version":"https://jsonfeed.org/version/1.1"}