A bug patched in 2023 came back in 2026, and the mitigation that worked last time does not work this time.
GeoServer jsonArrayContains — CVSS 9.8, unauthenticated SQL injection, no CVE number, exploitation attempts within hours of a public tweet. The fixed versions landed Friday. Your instances sat exposed all weekend.
WHAT ACTUALLY HAPPENED
On August 12 at 10:46 UTC, researcher @q1uf3ng posted the flaw straight to X. No vendor coordination, no advisory, no patch — just the technique, in public.
The bug lives in the jsonArrayContains filter function of the PostGIS DataStore. With PostGIS 12 or greater and a String or JSON field, the value argument is written into the generated SQL without escaping. An unauthenticated OGC filter request becomes arbitrary SQL. Where the database account is over-privileged, that path reaches remote code execution.
watchTowr began observing exploitation attempts within hours, then hundreds of them from a small pool of source IPs — probing, triggering errors, mapping who is vulnerable before anyone had a fix.
GeoServer shipped 3.0.1, 2.28.5 and 2.27.6 on August 14, tracked as GHSA-mqjf-5f49-2fjh.
WHY A REGRESSION IS WORSE THAN A NEW BUG
This is a regression of CVE-2023-25158, closed in February 2023. Same function, same class of flaw, three years later.
The dangerous detail is what the advisory says next: the mitigations that neutralised the 2023 flaw — enabling prepared statements, disabling function encoding — do not protect against this one. Teams who did exactly the right thing in 2023 are still carrying a control they believe holds.
That is the lesson. A mitigation is a snapshot of one code path at one moment. When the code regresses, the compensating control expires silently, and nobody sends you a notification.
WHAT TO DO NOW
UPGRADE TO 3.0.1, 2.28.5 OR 2.27.6 — the advisory is explicit that no workaround exists, so the version number is the only control that counts.
CHECK WHETHER YOU EMBED GEOTOOLS, NOT JUST GEOSERVER — the flaw sits in org.geotools:gt-jdbc-postgis (fixed in 35.1, 34.5, 33.6), so any application shipping that dependency inherits it.
STOP TRUSTING YOUR 2023 MITIGATION — prepared statements and disabled function encoding do not block this regression; verify the running version, not the setting.
HUNT BEFORE YOU RELAX — search OGC filter requests back to August 12 for jsonArrayContains and for SQL errors from your PostGIS user, then cut that account down to read-only on the layers it serves.
A patched vulnerability is not a permanently solved one. Code moves forward; your compensating controls stay where you left them.
When did you last re-test a mitigation you deployed years ago?