Skip to content
Fencer Vulns
medium 5.8

CVE-2025-53864 json

Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON

published 2025-07-11 15 mo ago modified 2026-09-10 1 mo ago also GHSA-xwmg-2g98-w7v9 , EUVD-2025-21099

cvss
5.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 62%
public exploits
0
none known

Summary

Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.

Patch / fix

  • maven com.nimbusds:nimbus-jose-jwt 9.37.4, 10.0.2
  • Connect2id Nimbus JOSE+JWT 10.0.2

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-53864 updated cvss 5.8

com.nimbusds/nimbus-jose-jwt: Uncontrolled recursion in Connect2id Nimbus JOSE + JWT

  • Red Hat Cryostat 4 nimbus-jose-jwt Red Hat Logging Subsystem for Red Hat OpenShift nimbus-jose-jwt Red Hat AMQ Broker 7 nimbus-jose-jwt Red Hat build of Apache Camel - HawtIO 4 nimbus-jose-jwt Red Hat build of Apache Camel 4 for Quarkus 3 nimbus-jose-jwt Red Hat build of Apache Camel for Spring Boot 4 nimbus-jose-jwt
    +8 more products
    Red Hat build of Apicurio Registry 2 nimbus-jose-jwt Red Hat build of Apicurio Registry 3 nimbus-jose-jwt Red Hat build of Quarkus nimbus-jose-jwt Red Hat Fuse 7 nimbus-jose-jwt Red Hat JBoss Enterprise Application Platform 7 nimbus-jose-jwt Red Hat JBoss Enterprise Application Platform 8 nimbus-jose-jwt Red Hat JBoss Enterprise Application Platform Expansion Pack nimbus-jose-jwt Red Hat streams for Apache Kafka 2 nimbus-jose-jwt
    affected: workaround, no fix available “Fix deferred”
  • Red Hat Streams for Apache Kafka 3.0.0
    fixed: vendor fix RHSA-2025:12511

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
15 mo ago

Exploit prediction

0.98% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • bitbucket.org https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
GitHub 3.1 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
maven com.nimbusds:nimbus-jose-jwt
>=9.38-rc1, <10.0.2
<9.37.4
10.0.2
9.37.4

Affected products

  • Connect2id Nimbus JOSE+JWT

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.