CVE-2025-30145
GeoServer has an Infinite Loop Vulnerability in Jiffle process
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
GeoServer has an Infinite Loop Vulnerability in Jiffle process
GeoServer is an open source server that allows users to share and edit geospatial data. Malicious Jiffle scripts can be executed by GeoServer, either as a rendering transformation in WMS dynamic styles or as a WPS process, that can enter an infinite loop to trigger denial of service. This vulnerability is fixed in 2.27.0, 2.26.3, and 2.25.7. This vulnerability can be mitigated by disabling WMS dynamic styling and the Jiffle process.
Reserved 2025-03-17 | Published 2025-06-10 | Updated 2025-06-10 | Assigner GitHub_MCWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
github.com/...server/security/advisories/GHSA-gr67-pwcv-76gf
github.com/geosolutions-it/jai-ext/pull/307
osgeo-org.atlassian.net/browse/GEOS-11778
Support options
