{"cve":"CVE-2025-30145","nvd":{"published":"2025-06-10T15:15:24.070","modified":"2026-06-17T09:08:14.830","status":"Analyzed","description":"GeoServer is an open source server that allows users to share and edit geospatial data. Malicious Jiffle scripts can be executed by GeoServer, either as a rendering transformation in WMS dynamic styles or as a WPS process, that can enter an infinite loop to trigger denial of service. This vulnerability is fixed in 2.27.0, 2.26.3, and 2.25.7. This vulnerability can be mitigated by disabling WMS dynamic styling and  the Jiffle process.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-835"],"references":["https://github.com/geoserver/geoserver/security/advisories/GHSA-gr67-pwcv-76gf","https://github.com/geosolutions-it/jai-ext/pull/307","https://osgeo-org.atlassian.net/browse/GEOS-11778"],"products":["osgeo:geoserver"],"source":"nvd","synced_at":"2026-10-19T22:02:23.998251710+00:00"},"epss":{"cve":"CVE-2025-30145","score":0.00512,"percentile":0.43699,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-gr67-pwcv-76gf","url":"https://osv.dev/vulnerability/GHSA-gr67-pwcv-76gf","summary":"GeoServer Infinite Loop Vulnerability in Jiffle process","modified":"2025-06-10T20:27:14.973839Z","packages":[{"ecosystem":"Maven","name":"org.geoserver.web:gs-web-app","purl":"pkg:maven/org.geoserver.web/gs-web-app","ranges":[">=2.26.0 <2.26.3"],"fixed":["2.26.3"]},{"ecosystem":"Maven","name":"org.geoserver:gs-wms","purl":"pkg:maven/org.geoserver/gs-wms","ranges":[">=2.26.0 <2.26.3"],"fixed":["2.26.3"]},{"ecosystem":"Maven","name":"org.geoserver.extension:gs-wps-core","purl":"pkg:maven/org.geoserver.extension/gs-wps-core","ranges":[">=2.26.0 <2.26.3"],"fixed":["2.26.3"]},{"ecosystem":"Maven","name":"org.geoserver.web:gs-web-app","purl":"pkg:maven/org.geoserver.web/gs-web-app","ranges":["<2.25.7"],"fixed":["2.25.7"]},{"ecosystem":"Maven","name":"org.geoserver:gs-wms","purl":"pkg:maven/org.geoserver/gs-wms","ranges":["<2.25.7"],"fixed":["2.25.7"]},{"ecosystem":"Maven","name":"org.geoserver.extension:gs-wps-core","purl":"pkg:maven/org.geoserver.extension/gs-wps-core","ranges":["<2.25.7"],"fixed":["2.25.7"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}