PT-2025-24672 · Geoserver · Geoserver

Sikeoka · Published 2025-06-10 · Updated 2025-06-10 · CVE-2025-30145

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GeoServer versions prior to 2.25.7 GeoServer versions prior to 2.26.3 GeoServer versions prior to 2.27.0

Description The issue allows malicious Jiffle scripts to be executed, potentially triggering a denial of service through an infinite loop. This can occur when the scripts are used as a rendering transformation in WMS dynamic styles or as a WPS process.

Recommendations For versions prior to 2.25.7, update to version 2.25.7 or later. For versions prior to 2.26.3, update to version 2.26.3 or later. For versions prior to 2.27.0, update to version 2.27.0 or later. As a temporary workaround, consider disabling WMS dynamic styling and the Jiffle process to mitigate the risk of exploitation.

Exploit

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

CVE-2025-30145

GHSA-GR67-PWCV-76GF

Affected Products

Geoserver

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30145.json · Exploit
• https://github.com/geosolutions-it/jai-ext/pull/307 · Patch
• https://osv.dev/vulnerability/GHSA-gr67-pwcv-76gf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-30145 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30145 · Vendor Advisory
• https://github.com/geoserver/geoserver · Note
• https://github.com/geoserver/geoserver/security/advisories/GHSA-gr67-pwcv-76gf · Note
• https://twitter.com/VulmonFeeds/status/1932500071045537797 · Twitter Post
• https://t.me/latest_high_impact_cve/2601 · Telegram Post
• https://twitter.com/CVEnew/status/1932457035355828501 · Twitter Post
• https://osgeo-org.atlassian.net/browse/GEOS-11778 · Note