7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-30145

CVE-2025-30145: GeoServer Infinite Loop Vulnerability in Jiffle process

Summary

Malicious Jiffle scripts can be executed by GeoServer, either as a rendering transformation in WMS dynamic styles or as a WPS process, that can enter an infinite loop to trigger denial of service.

Details

The Jiffle language supports multiple loop constructs that will cause its code block to be continuously executed until a certain condition is met. The Jiffle runtime should be updated to throw an exception if the script exceeds a certain number of loop iterations.

Impact

This vulnerability allows attackers to conduct denial-of-service attacks.

Mitigation

This vulnerability can be mitigated by disabling WMS dynamic styling (see WMS Settings). If the WPS extension is installed, the Jiffle process must also be disabled to mitigate this vulnerability (see WPS Settings)

References

https://github.com/geosolutions-it/jai-ext/pull/307 https://osgeo-org.atlassian.net/browse/GEOS-11778

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-30145

CVE-2025-30145:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.geoserver.web:gs-web-app	maven	>= 2.26.0, <= 2.26.2	2.26.3
org.geoserver:gs-wms	maven	>= 2.26.0, <= 2.26.2	2.26.3
org.geoserver.extension:gs-wps-core	maven	>= 2.26.0, <= 2.26.2	2.26.3
org.geoserver.web:gs-web-app	maven	<= 2.25.6	2.25.7
org.geoserver:gs-wms	maven	<= 2.25.6	2.25.7
org.geoserver.extension:gs-wps-core	maven	<= 2.25.6	2.25.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows malicious Jiffle scripts to cause a Denial of Service by entering an infinite loop. Jiffle scripts are parsed and compiled into Java code, specifically into classes that extend AbstractJiffleRuntime (e.g., AbstractDirectRuntime, AbstractIndirectRuntime). The core logic, including loops, is executed within the evaluate methods of these generated classes.

The vulnerability existed because the methods responsible for generating the Java code for Jiffle loop constructs (e.g., While.write, Until.write, LoopInRange.write) in the it.geosolutions.jaiext.jiffle.parser.node package did not include any mechanism to limit the number of iterations. Consequently, when a Jiffle script with an unbounded loop was processed, the evaluate method of the corresponding runtime instance would execute this loop indefinitely.

The patch addresses this by:

Introducing an iteration counting mechanism in it.geosolutions.jaiext.jiffle.runtime.AbstractJiffleRuntime (fields _iterations, _maxIterations, and method checkLoopIterations()).
Modifying the write methods in the parser.node classes to inject calls to checkLoopIterations() at the beginning of each generated loop block.
Initializing the iteration counter (_iterations = 0;) at the start of the generated evaluate methods (evident from changes in it.geosolutions.jaiext.jiffle.parser.node.Script.write and the patched reference/*.java files).

Therefore, the evaluate methods of the Jiffle runtime are the primary functions where the infinite loop would manifest during exploitation. The write methods in the parser are culpable for generating the vulnerable loop code. Both are critical to understanding the vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.