CVE-2026-90775

PostGIS address_standardizer versions through 3.7.0 fail to validate the Weight parameter from caller-supplied rules tables before using it as an array index in the load_value array. Attackers with low privileges can craft malicious rule rows with out-of-range Weight values, triggering an out-of-...

CVE-2026-90775

PostGIS addressstandardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the loadvalue array, causing the PostgreS...

PT-2026-90844

PostGIS address standardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the load value array, causing the...

Linux Distros Unpatched Vulnerability : CVE-2026-90775

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PostGIS addressstandardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers...

AlmaLinux 10 : postgresql16-postgis (ALSA-2026:65899)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:65899 advisory. postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer CVE-2026-73515 Tenable has extracted the preceding description block...

Oracle Linux 10 : ELSA-2026-65899-0: / postgresql16-postgis (ELSA-2026-658990)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-658990 advisory. 3.5.3-4.1 - Fix CVE-2026-73515: validate flatgeobuf input buffers before decoding Tenable has extracted the preceding description block directly from the...

postgresql16-postgis security update

An update is available for postgresql16-postgis. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list PostGIS adds support for geographic objects to the PostgreSQL...

RLSA-2026:65899 Important: postgresql16-postgis security update

PostGIS adds support for geographic objects to the PostgreSQL object-relational database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic information systems GIS, much like ESRI's SDE or Oracle's Spatial extension...

RockyLinux 10 : postgresql16-postgis (RLSA-2026:65899)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:65899 advisory. postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer CVE-2026-73515 Tenable has extracted the preceding description block...

postgresql16-postgis security update

3.5.3-4.1 - Fix CVE-2026-73515: validate flatgeobuf input buffers before decoding...

Important: Red Hat Security Advisory: postgresql16-postgis security update

An update for postgresql16-postgis is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer

A flaw was found in PostGIS. This out-of-bounds read vulnerability allows a remote attacker to cause memory disclosure or a server crash. This occurs when a malformed FlatGeobuf buffer is supplied, as the FlatGeobuf property metadata decoder fails to verify that the string body is contained withi...

RHEL 10 : postgresql16-postgis (RHSA-2026:65899)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:65899 advisory. PostGIS adds support for geographic objects to the PostgreSQL object-relational database. In effect, PostGIS spatially enables the PostgreSQL serve...

ALSA-2026:65899 Important: postgresql16-postgis security update

PostGIS adds support for geographic objects to the PostgreSQL object-relational database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic information systems GIS, much like ESRI's SDE or Oracle's Spatial extension...

CVE-2026-76904

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...

GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

Summary An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function Requires PostGIS 12 or greater with a String or JSON field For PostGIS 12 and greater jsonArrayContains, , function writes into generated SQL without...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the jsonArrayContains function. An attacker can execute arbitrary SQL statements by supplying crafted input to the filter, which is incorporated into SQL queries without proper escaping. Remediation Upgrade...

GHSA-MQJF-5F49-2FJH GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

Summary An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function Requires PostGIS 12 or greater with a String or JSON field For PostGIS 12 and greater jsonArrayContains, , function writes into generated SQL without...

EUVD-2026-64133

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...

CVE-2026-76904 GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: jsonArrayContains function; Requires...