Advisory details:
github_osv / GHSA-gr67-pwcv-76gf
| Advisory ID | github_osv/GHSA-gr67-pwcv-76gf |
| Aliases |
CVE-2025-30145
|
| Summary | GeoServer Infinite Loop Vulnerability in Jiffle process ### Summary Malicious Jiffle scripts can be executed by GeoServer, either as a rendering transformation in WMS dynamic styles or as a WPS process, that can enter an infinite loop to trigger denial of service. ### Details The Jiffle language supports multiple loop constructs that will cause its code block to be continuously executed until a certain condition is met. The Jiffle runtime should be updated to throw an exception if the script exceeds a certain number of loop iterations. ### Impact This vulnerability allows attackers to conduct denial-of-service attacks. ### Mitigation This vulnerability can be mitigated by disabling WMS dynamic styling (see [WMS Settings](https://docs.geoserver.org/latest/en/user/services/wms/webadmin.html#disabling-usage-of-dynamic-styling-in-getmap-getfeatureinfo-and-getlegendgraphic-requests)). If the WPS extension is installed, the Jiffle process must also be disabled to mitigate this vulnerability (see [WPS Settings](https://docs.geoserver.org/latest/en/user/services/wps/security.html#input-limits)) ### References https://github.com/geosolutions-it/jai-ext/pull/307 https://osgeo-org.atlassian.net/browse/GEOS-11778 |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 6.8 |
| Risk | 3.4 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 7.5 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-gr67-pwcv-76gf/GHSA-gr67-pwcv-76gf.json |
| generic_textual | HIGH |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/geoserver/geoserver | ||
| https://github.com/geosolutions-it/jai-ext/pull/307 | ||
| https://osgeo-org.atlassian.net/browse/GEOS-11778 | ||
| CVE-2025-30145 | https://nvd.nist.gov/vuln/detail/CVE-2025-30145 | |
| GHSA-gr67-pwcv-76gf | https://github.com/geoserver/geoserver/security/advisories/GHSA-gr67-pwcv-76gf |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
There are no SSVC decisions available.