CVE-2025-30145

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-30145
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30145.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-30145
Aliases
Published
2025-06-10T14:58:48.408Z
Modified
2026-07-15T01:49:04.192516929Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
GeoServer has an Infinite Loop Vulnerability in Jiffle process
Details

GeoServer is an open source server that allows users to share and edit geospatial data. Malicious Jiffle scripts can be executed by GeoServer, either as a rendering transformation in WMS dynamic styles or as a WPS process, that can enter an infinite loop to trigger denial of service. This vulnerability is fixed in 2.27.0, 2.26.3, and 2.25.7. This vulnerability can be mitigated by disabling WMS dynamic styling and the Jiffle process.

Database specific 
{
    "cwe_ids": [
        "CWE-835"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30145.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/geoserver/geoserver

Affected ranges

Type
GIT
Repo
https://github.com/geoserver/geoserver
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
035172d66d5225f758d789b0863bd46b2f7c15e8
Introduced
8f9b3e407de0b6a7d30fb9edf68ac6db0071b7bb
Fixed
4a7a6881894a879f097ca2f04d62733fcdaa2937
Database specific 
{
    "cpe": "cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.25.7"
        },
        {
            "introduced": "2.26.0"
        },
        {
            "fixed": "2.26.3"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

2.*
2.11-beta
2.21-M0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-30145.json"