CVE-2025-30145CWE-835

GeoServer has an Infinite Loop Vulnerability in Jiffle process

High · published June 10, 2025

CVSS v3.1
7.5
EPSS
1%
Percentile
42.8
In the wild
Unconfirmed
What it is

GeoServer is an open source server that allows users to share and edit geospatial data. Malicious Jiffle scripts can be executed by GeoServer, either as a rendering transformation in WMS dynamic styles or as a WPS process, that can enter an infinite loop to trigger denial of service. This vulnerability is fixed in 2.27.0, 2.26.3, and 2.25.7. This vulnerability can be mitigated by disabling WMS dynamic styling and the Jiffle process.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00512 · 42.8th percentile
Weakness
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2025-06-10T14:58Z
EPSS history
Timeline
  • 10 JUN 14:58Z
    GeoServer has an Infinite Loop Vulnerability in Jiffle process
    cvelistv5