CVE-2025-53864
Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON
Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.
- Record
CVE-2025-53864- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - Weakness
- CWE-674
- Updated
- 2026-11-02
EUVDEUVD-2025-21099
Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.
- Record
EUVD-2025-21099- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xwmg-2g98-w7v9
Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON
Connect2id Nimbus JOSE + JWT before 10.0.2 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.
- Record
GHSA-xwmg-2g98-w7v9- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - Weakness
- CWE-674
- Updated
- 2026-11-02
NVD
Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.
- Record
CVE-2025-53864- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - Weakness
- CWE-674
- Updated
- 2026-11-02
OSV
Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.
- Record
CVE-2025-53864- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - Weakness
- CWE-674
- Updated
- 2026-11-02
OSVGHSA-xwmg-2g98-w7v9
Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON
Connect2id Nimbus JOSE + JWT before 10.0.2 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.
- Record
GHSA-xwmg-2g98-w7v9- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - Weakness
- CWE-674
- Updated
- 2026-11-02
Show 9 moreShow less
OSVRHLW-2026-4d628364a5512412
Lightwell Security Advisory: nimbus-jose-jwt 9.7.0.rhlw-00004
Red Hat Lightwell has released com.nimbusds:nimbus-jose-jwt 9.7.0.rhlw-00004 with a backported security fix.
CVE-2025-53864: Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.
This patched artifact is a drop-in replacement for com.nimbusds:nimbus-jose-jwt 9.7.0 from Maven Central.
- Record
RHLW-2026-4d628364a5512412- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-53864
Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.
- Record
UBUNTU-CVE-2025-53864- CVSS 3.1
- 5.8 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L - Updated
- 2026-11-02
OSVCLSA-2025-1760918790 No score
TuxCare security update for com.google.code.gson:gson (1 CVE)
TuxCare rebuilt com.google.code.gson:gson to address 1 CVE. Fixed in 2.9.1-tuxcare.1.
- Record
CLSA-2025-1760918790- Updated
- 2026-11-02
OSVCLSA-2025-1762474006 No score
TuxCare security update for com.nimbusds:nimbus-jose-jwt (1 CVE)
TuxCare rebuilt com.nimbusds:nimbus-jose-jwt to address 1 CVE. Fixed in 9.22-tuxcare.2.
- Record
CLSA-2025-1762474006- Updated
- 2026-11-03
OSVCLSA-2025-1764806871 No score
TuxCare security update for com.google.code.gson (2 CVEs)
TuxCare rebuilt 2 com.google.code.gson packages to address 2 CVEs. Fixed in 2.8.5-tuxcare.1.
- Record
CLSA-2025-1764806871- Updated
- 2026-11-02
OSVCLSA-2026-1769990936 No score
TuxCare security update for com.google.code.gson (1 CVE)
TuxCare rebuilt 2 com.google.code.gson packages to address 1 CVE. Fixed in 2.8.9-tuxcare.1.
- Record
CLSA-2026-1769990936- Updated
- 2026-11-02
OSVCLSA-2026-1784423325 No score
TuxCare security update for com.nimbusds:nimbus-jose-jwt (1 CVE)
TuxCare rebuilt com.nimbusds:nimbus-jose-jwt to address 1 CVE. Fixed in 9.39.3-tuxcare.1.
- Record
CLSA-2026-1784423325- Updated
- 2026-11-02
OSVCLSA-2026-1784423326 No score
TuxCare security update for com.nimbusds:nimbus-jose-jwt (1 CVE)
TuxCare rebuilt com.nimbusds:nimbus-jose-jwt to address 1 CVE. Fixed in 9.37.3-tuxcare.1.
- Record
CLSA-2026-1784423326- Updated
- 2026-11-02
OSVCLSA-2026-1791931295 No score
TuxCare security update for com.google.code.gson:gson (2 CVEs)
TuxCare rebuilt com.google.code.gson:gson to address 2 CVEs. Fixed in 2.2.2-tuxcare.1.
- Record
CLSA-2026-1791931295- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
com.nimbusds:nimbus-jose-jwtMaven |
before 9.37.4 | 9.37.4 |
com.nimbusds:nimbus-jose-jwtMaven |
9.38-rc1 up to 10.0.2 | 10.0.2 |
com.google.code.gson:gsonTuxCare:Maven |
2.9.1 up to 2.9.1-tuxcare.1 | 2.9.1-tuxcare.1 |
com.nimbusds:nimbus-jose-jwtTuxCare:Maven |
9.22 up to 9.22-tuxcare.2, plus listed versions 9.22.tuxcare |
9.22-tuxcare.2 |
com.google.code.gson:gsonTuxCare:Maven |
2.8.5 up to 2.8.5-tuxcare.1 | 2.8.5-tuxcare.1 |
com.google.code.gson:gson-parentTuxCare:Maven |
2.8.5 up to 2.8.5-tuxcare.1 | 2.8.5-tuxcare.1 |
com.google.code.gson:gsonTuxCare:Maven |
2.8.9 up to 2.8.9-tuxcare.1 | 2.8.9-tuxcare.1 |
com.google.code.gson:gson-parentTuxCare:Maven |
2.8.9 up to 2.8.9-tuxcare.1 | 2.8.9-tuxcare.1 |
com.nimbusds:nimbus-jose-jwtTuxCare:Maven |
9.39.3 up to 9.39.3-tuxcare.1 | 9.39.3-tuxcare.1 |
com.nimbusds:nimbus-jose-jwtTuxCare:Maven |
9.37.3 up to 9.37.3-tuxcare.1 | 9.37.3-tuxcare.1 |
Show 12 moreShow less
| Package | Affected | Fixed |
|---|---|---|
com.google.code.gson:gsonTuxCare:Maven |
2.2.2 up to 2.2.2-tuxcare.1 | 2.2.2-tuxcare.1 |
com.nimbusds:nimbus-jose-jwtMaven |
9.38-rc1 up to 10.0.2, plus listed versions 10.010.0.19.389.38-rc39.38-rc4 Show 16 moreShow less9.38-rc59.399.39.19.39.29.39.39.409.419.41.19.41.29.429.439.449.459.469.479.48 |
10.0.2 |
com.nimbusds:nimbus-jose-jwtMaven |
before 9.37.4, plus listed versions 2.102.10.12.11.02.12.02.13.0 Show 45 moreShow less2.13.12.14.02.15.02.15.12.15.22.162.172.17.12.17.22.182.18.12.18.22.192.19.12.202.212.222.22.12.232.242.252.262.26.12.93.03.13.1.13.1.23.103.23.2.13.2.23.33.43.53.63.73.83.8.13.8.23.93.9.13.9.24.04.0-rc1 |
9.37.4 |
com.nimbusds:nimbus-jose-jwtRed Hat Lightwell:Maven |
before 9.7.0.rhlw-00004, plus listed versions 2.102.10.12.11.02.12.02.13.0 Show 45 moreShow less2.13.12.14.02.15.02.15.12.15.22.162.172.17.12.17.22.182.18.12.18.22.192.19.12.202.212.222.22.12.232.242.252.262.26.12.93.03.13.1.13.1.23.103.23.2.13.2.23.33.43.53.63.73.83.8.13.8.23.93.9.13.9.24.04.0-rc1 |
9.7.0.rhlw-00004 |
libgoogle-gson-javaUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2.2.4-12.4-12.4-1ubuntu0.1~esm1 |
None known |
libgoogle-gson-javaUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.4-22.8.2-12.8.5-3~18.042.8.5-3~18.04.1~esm1 |
None known |
libgoogle-gson-javaUbuntu:20.04:LTS |
All versions, plus listed versions 2.8.5-32.8.5-3+deb10u1build0.20.04.1 |
None known |
libgoogle-gson-javaUbuntu:22.04:LTS |
All versions, plus listed versions 2.8.6-12.8.8-12.8.8-1ubuntu0.1 |
None known |
libgoogle-gson-javaUbuntu:24.04:LTS |
All versions, plus listed versions 2.10-12.10.1-1 |
None known |
libgoogle-gson-javaUbuntu:25.10 |
All versions, plus listed versions 2.10.1-1 |
None known |
libgoogle-gson-javaUbuntu:26.10 |
All versions, plus listed versions 2.10.1-1 |
None known |
libgoogle-gson-javaUbuntu:26.04:LTS |
All versions, plus listed versions 2.10.1-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-53864 is a medium vulnerability (CVSS 5.8) in Connect2id Nimbus Jose+jwt, published July 11, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.98%, the 62nd percentile. Fixed in com.nimbusds:nimbus-jose-jwt 9.37.4.
References
bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested
github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0
nvd.nist.gov/vuln/detail/CVE-2025-53864
Left out here: 378 versions. The JSON record has them.