Log in Start free

Vulnerability · Published Jun 10, 2025 · Assigned by GitHub_M

CVE-2025-30145GeoServer has an Infinite Loop Vulnerability in Jiffle process

High 7.5

In plain English

A high-severity infinite loop in geoserver from geoserver. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.5%top 54.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

GeoServer is an open source server that allows users to share and edit geospatial data. Malicious Jiffle scripts can be executed by GeoServer, either as a rendering transformation in WMS dynamic styles or as a WPS process, that can enter an infinite loop to trigger denial of service. This vulnerability is fixed in 2.27.0, 2.26.3, and 2.25.7. This vulnerability can be mitigated by disabling WMS dynamic styling and the Jiffle process.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Mavenorg.geoserver.extension:gs-wps-core2.26.3GHSA-gr67-pwcv-76gf
Mavenorg.geoserver.extension:gs-wps-core2.25.7GHSA-gr67-pwcv-76gf
Mavenorg.geoserver.web:gs-web-app2.26.3GHSA-gr67-pwcv-76gf
Mavenorg.geoserver.web:gs-web-app2.25.7GHSA-gr67-pwcv-76gf
Mavenorg.geoserver:gs-wms2.26.3GHSA-gr67-pwcv-76gf
Mavenorg.geoserver:gs-wms2.25.7GHSA-gr67-pwcv-76gf

Affected products (as reported)

VendorProductVersions
geoserver geoserver >= 2.26.0, < 2.26.3< 2.25.7

Weakness: CWE-835 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References