GHSA-gr67-pwcv-76gf CVE-2025-30145
GeoServer Infinite Loop Vulnerability in Jiffle process
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.51%
- Chance of exploitation in the next 30 days. Higher than 43.69% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
- Fix
- Available
- 3 packages have a fixed version
Description
Summary
Malicious Jiffle scripts can be executed by GeoServer, either as a rendering transformation in WMS dynamic styles or as a WPS process, that can enter an infinite loop to trigger denial of service.
Details
The Jiffle language supports multiple loop constructs that will cause its code block to be continuously executed until a certain condition is met. The Jiffle runtime should be updated to throw an exception if the script exceeds a certain number of loop iterations.
Impact
This vulnerability allows attackers to conduct denial-of-service attacks.
Mitigation
This vulnerability can be mitigated by disabling WMS dynamic styling (see WMS Settings). If the WPS extension is installed, the Jiffle process must also be disabled to mitigate this vulnerability (see WPS Settings)
References
https://github.com/geosolutions-it/jai-ext/pull/307 https://osgeo-org.atlassian.net/browse/GEOS-11778
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.geoserver.extension:gs-wps-core | >= 2.26.0, < 2.26.3 |
2.26.3 |
| org.geoserver.extension:gs-wps-core | < 2.25.7 |
2.25.7 |
| org.geoserver.web:gs-web-app | >= 2.26.0, < 2.26.3 |
2.26.3 |
| org.geoserver.web:gs-web-app | < 2.25.7 |
2.25.7 |
| org.geoserver:gs-wms | >= 2.26.0, < 2.26.3 |
2.26.3 |
| org.geoserver:gs-wms | < 2.25.7 |
2.25.7 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.geoserver.extension:gs-wps-core Maven → 2.26.3
- maven
<dependency><groupId>org.geoserver.extension</groupId><artifactId>gs-wps-core</artifactId><version>2.26.3</version></dependency>- gradle
implementation("org.geoserver.extension:gs-wps-core:2.26.3")
org.geoserver.web:gs-web-app Maven → 2.26.3
- maven
<dependency><groupId>org.geoserver.web</groupId><artifactId>gs-web-app</artifactId><version>2.26.3</version></dependency>- gradle
implementation("org.geoserver.web:gs-web-app:2.26.3")
org.geoserver:gs-wms Maven → 2.26.3
- maven
<dependency><groupId>org.geoserver</groupId><artifactId>gs-wms</artifactId><version>2.26.3</version></dependency>- gradle
implementation("org.geoserver:gs-wms:2.26.3")
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-fjf5-xgmq-5525 GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature | Critical Known exploited | Also affects org.geoserver:gs-wms |
| GHSA-6jj6-gm7p-fcvv Remote Code Execution (RCE) vulnerability in geoserver | Critical Known exploited | Also affects org.geoserver:gs-wms |
| GHSA-wf6j-gr27-g7ch GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates | High | Also affects org.geoserver:gs-wms |
| GHSA-x4r9-gmw3-hxww GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution | High | Also affects org.geoserver.web:gs-web-app |
| GHSA-7qmg-grcp-qf25 GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page | High | Also affects org.geoserver.web:gs-web-app |
| GHSA-w66h-j855-qr72 GeoServer has a Reflected Cross-Site Scripting (XSS) vulnerability in its WMS GetFeatureInfo HTML format | Medium | Also affects org.geoserver:gs-wms |
| GHSA-jj54-8f66-c5pc [XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service | Critical | Also affects org.geoserver.web:gs-web-app |
| GHSA-h86g-x8mm-78m5 GeoServer Missing Authorization on REST API Index | Medium | Also affects org.geoserver.web:gs-web-app |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor