Vulnerability · Published Jul 11, 2025 · Assigned by mitre
CVE-2025-53864
Medium 5.8
In plain English
A medium-severity security flaw in Nimbus JOSE+JWT from Connect2id. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.nimbusds:nimbus-jose-jwt | 9.37.4 | GHSA-xwmg-2g98-w7v9 |
| Maven | com.nimbusds:nimbus-jose-jwt | 10.0.2 | GHSA-xwmg-2g98-w7v9 |
| Ubuntu:22.04:LTS | libgoogle-gson-java | no fix listed | UBUNTU-CVE-2025-53864 |
| Ubuntu:24.04:LTS | libgoogle-gson-java | no fix listed | UBUNTU-CVE-2025-53864 |
| Ubuntu:25.10 | libgoogle-gson-java | no fix listed | UBUNTU-CVE-2025-53864 |
| Ubuntu:26.04:LTS | libgoogle-gson-java | no fix listed | UBUNTU-CVE-2025-53864 |
| Ubuntu:26.10 | libgoogle-gson-java | no fix listed | UBUNTU-CVE-2025-53864 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Connect2id | Nimbus JOSE+JWT | 0 – before 10.0.2 |
Weakness: CWE-674 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
References
- https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested
- https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0
- https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b
- https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c
- https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch