← Back

CVE-2025-30145

nvd nist
Published: Jun 10, 2025Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: security-advisories@github.com (Secondary)

Description

GeoServer is an open source server that allows users to share and edit geospatial data. Malicious Jiffle scripts can be executed by GeoServer, either as a rendering transformation in WMS dynamic styles or as a WPS process, that can enter an infinite loop to trigger denial of service. This vulnerability is fixed in 2.27.0, 2.26.3, and 2.25.7. This vulnerability can be mitigated by disabling WMS dynamic styling and the Jiffle process.

Affected (2)

Products: Osgeo: Geoserver
Osgeo
1 product
Geoserver
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Osgeo
Geoserver
Before 2.25.7
Geoserver
From 2.26.0 to 2.26.3

Related CWEs

CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

References (3)

Source: security-advisories@github.com
Third Party Advisory
Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Permissions Required

Timeline

No history available yet.