{"id":"GHSA-gr67-pwcv-76gf","summary":"GeoServer Infinite Loop Vulnerability in Jiffle process","details":"### Summary\nMalicious Jiffle scripts can be executed by GeoServer, either as a rendering transformation in WMS dynamic styles or as a WPS process, that can enter an infinite loop to trigger denial of service.\n\n### Details\nThe Jiffle language supports multiple loop constructs that will cause its code block to be continuously executed until a certain condition is met. The Jiffle runtime should be updated to throw an exception if the script exceeds a certain number of loop iterations.\n\n### Impact\nThis vulnerability allows attackers to conduct denial-of-service attacks.\n\n### Mitigation\nThis vulnerability can be mitigated by disabling WMS dynamic styling (see [WMS Settings](https://docs.geoserver.org/latest/en/user/services/wms/webadmin.html#disabling-usage-of-dynamic-styling-in-getmap-getfeatureinfo-and-getlegendgraphic-requests)).\nIf the WPS extension is installed, the Jiffle process must also be disabled to mitigate this vulnerability (see [WPS Settings](https://docs.geoserver.org/latest/en/user/services/wps/security.html#input-limits))\n\n### References\nhttps://github.com/geosolutions-it/jai-ext/pull/307\nhttps://osgeo-org.atlassian.net/browse/GEOS-11778","aliases":["CVE-2025-30145"],"modified":"2025-06-10T20:27:14.973839Z","published":"2025-06-10T19:44:31Z","database_specific":{"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2025-06-10T19:44:31Z","nvd_published_at":"2025-06-10T15:15:24Z","cwe_ids":["CWE-835"]},"references":[{"type":"WEB","url":"https://github.com/geoserver/geoserver/security/advisories/GHSA-gr67-pwcv-76gf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30145"},{"type":"WEB","url":"https://github.com/geosolutions-it/jai-ext/pull/307"},{"type":"PACKAGE","url":"https://github.com/geoserver/geoserver"},{"type":"WEB","url":"https://osgeo-org.atlassian.net/browse/GEOS-11778"}],"affected":[{"package":{"name":"org.geoserver.web:gs-web-app","ecosystem":"Maven","purl":"pkg:maven/org.geoserver.web/gs-web-app"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.26.0"},{"fixed":"2.26.3"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 2.26.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-gr67-pwcv-76gf/GHSA-gr67-pwcv-76gf.json"}},{"package":{"name":"org.geoserver:gs-wms","ecosystem":"Maven","purl":"pkg:maven/org.geoserver/gs-wms"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.26.0"},{"fixed":"2.26.3"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 2.26.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-gr67-pwcv-76gf/GHSA-gr67-pwcv-76gf.json"}},{"package":{"name":"org.geoserver.extension:gs-wps-core","ecosystem":"Maven","purl":"pkg:maven/org.geoserver.extension/gs-wps-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.26.0"},{"fixed":"2.26.3"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 2.26.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-gr67-pwcv-76gf/GHSA-gr67-pwcv-76gf.json"}},{"package":{"name":"org.geoserver.web:gs-web-app","ecosystem":"Maven","purl":"pkg:maven/org.geoserver.web/gs-web-app"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.7"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 2.25.6","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-gr67-pwcv-76gf/GHSA-gr67-pwcv-76gf.json"}},{"package":{"name":"org.geoserver:gs-wms","ecosystem":"Maven","purl":"pkg:maven/org.geoserver/gs-wms"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.7"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-gr67-pwcv-76gf/GHSA-gr67-pwcv-76gf.json","last_known_affected_version_range":"\u003c= 2.25.6"}},{"package":{"name":"org.geoserver.extension:gs-wps-core","ecosystem":"Maven","purl":"pkg:maven/org.geoserver.extension/gs-wps-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.7"}]}],"database_specific":{"last_known_affected_version_range":"\u003c= 2.25.6","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-gr67-pwcv-76gf/GHSA-gr67-pwcv-76gf.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}