Geoserver EUVD-2025-17684

This vulnerability presents HIGH real-world risk despite a moderate CVSS score of 7.5. CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates maximum attack accessibility (network-accessible, no authentication required, low attack complexity) with high availability impact. The attack requires no privileges or user interaction, making exploitation trivial. The vulnerability is NOT limited to specific impact—any unauthenticated attacker can trigger DoS from the network. While the CVSS score of 7.5 reflects the high availability impact with no confidentiality/integrity breach, the real-world exploitability is CRITICAL due to the low barrier to entry. GeoServer deployments handling public or untrusted WMS/WPS requests are especially vulnerable. The provided mitigation options (disabling WMS dynamic styling and Jiffle process) indicate this can be partially controlled through configuration but represents operational risk if these features are needed.

An unauthenticated attacker discovers a publicly accessible GeoServer WMS endpoint. The attacker crafts a malicious WMS GetMap request with a custom rendering transformation containing a Jiffle script designed to loop infinitely (e.g., 'x=x+1; while(true) {}' or similar construct that bypasses loop exit conditions). Alternatively, the attacker submits a malicious WPS Execute request with a Jiffle process containing the same infinite loop payload. GeoServer processes the request without proper input validation, causing the Jiffle script interpreter to enter an infinite loop, consuming 100% CPU on the server thread. Within seconds, the GeoServer instance becomes unresponsive, denying legitimate users access to geospatial data services. If the attacker submits multiple concurrent requests, the DoS impact escalates across all available threads. No proof-of-concept code needs to be sophisticated—basic scripting knowledge suffices to trigger the vulnerability. This is particularly impactful for critical infrastructure or mapping services relying on GeoServer.