Vulnerabilities in pkg:maven/org.geoserver.extension/gs-wps-core

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-gr67-pwcv-76gf",
  "modified" : "2025-06-10T19:44:31Z",
  "published" : "2025-06-10T19:44:31Z",
  "aliases" : [ "CVE-2025-30145" ],
  "summary" : "GeoServer Infinite Loop Vulnerability in Jiffle process",
  "details" : "### Summary\nMalicious Jiffle scripts can be executed by GeoServer, either as a rendering transformation in WMS dynamic styles or as a WPS process, that can enter an infinite loop to trigger denial of service.\n\n### Details\nThe Jiffle language supports multiple loop constructs that will cause its code block to be continuously executed until a certain condition is met. The Jiffle runtime should be updated to throw an exception if the script exceeds a certain number of loop iterations.\n\n### Impact\nThis vulnerability allows attackers to conduct denial-of-service attacks.\n\n### Mitigation\nThis vulnerability can be mitigated by disabling WMS dynamic styling (see [WMS Settings](https://docs.geoserver.org/latest/en/user/services/wms/webadmin.html#disabling-usage-of-dynamic-styling-in-getmap-getfeatureinfo-and-getlegendgraphic-requests)).\nIf the WPS extension is installed, the Jiffle process must also be disabled to mitigate this vulnerability (see [WPS Settings](https://docs.geoserver.org/latest/en/user/services/wps/security.html#input-limits))\n\n### References\nhttps://github.com/geosolutions-it/jai-ext/pull/307\nhttps://osgeo-org.atlassian.net/browse/GEOS-11778",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.geoserver.web:gs-web-app"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.26.0"
      }, {
        "fixed" : "2.26.3"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.26.2"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.geoserver:gs-wms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.26.0"
      }, {
        "fixed" : "2.26.3"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.26.2"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.geoserver.extension:gs-wps-core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.26.0"
      }, {
        "fixed" : "2.26.3"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.26.2"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.geoserver.web:gs-web-app"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.25.7"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.25.6"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.geoserver:gs-wms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.25.7"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.25.6"
    }
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.geoserver.extension:gs-wps-core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.25.7"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 2.25.6"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/geoserver/geoserver/security/advisories/GHSA-gr67-pwcv-76gf"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-30145"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/geosolutions-it/jai-ext/pull/307"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/geoserver/geoserver"
  }, {
    "type" : "WEB",
    "url" : "https://osgeo-org.atlassian.net/browse/GEOS-11778"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-835" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-06-10T19:44:31Z",
    "nvd_published_at" : "2025-06-10T15:15:24Z"
  }
}