CVE-2025-53864

MEDIUM

Connect2id Nimbus JOSE + JWT <10.0.2-9.37.4 - DoS

Title source: llm
STIX 2.1

Description

Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.

References (5)

Core 5

Scores

CVSS v3 5.8
EPSS 0.0081
EPSS Percentile 51.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-674
Status published
Products (2)
com.nimbusds/nimbus-jose-jwt 9.38-rc1 - 10.0.2Maven
Connect2id/Nimbus JOSE+JWT < 10.0.2
Published Jul 11, 2025
Tracked Since Feb 18, 2026