GitHub Advisoryadvisory · Maven

GHSA-xwmg-2g98-w7v9 Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON

MEDIUM Published 2025-07-11 Modified 2025-09-19 Official page ↗
Aliases
CVE-2025-53864
Ecosystem
Maven
Packages
com.nimbusds:nimbus-jose-jwt
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Weaknesses
CWE-674
Reviewed
2025-07-11

Affected packages

• Maven com.nimbusds:nimbus-jose-jwt: >= 9.38-rc1, < 10.0.2 → fixed in 10.0.2 • Maven com.nimbusds:nimbus-jose-jwt: < 9.37.4 → fixed in 9.37.4

Description

Connect2id Nimbus JOSE + JWT before 10.0.2 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.

Related

Alias · CVE (1)

  • CVE-2025-53864 Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a… vulnerability

Weakness · CWE (1)

  • CWE-674 Uncontrolled Recursion weakness

References