Nimbus Jose+Jwt

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:connect2id:nimbus_jose+jwt:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorConnect2Id (c91c7893-f98d-5031-bb58-d34cc4e06c3f)
ProductNimbus Jose+Jwt (0cfc51ac-d909-5d3c-a620-693aacf43872)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*

Notes

Imported from gcve-enriched-dumps CVE data

PURL mappings

PURLSourceLast updated
pkg:bitbucket/connect2id/nimbus-jose-jwt purl2cpe 2026-10-12 21:11:59.842065
pkg:github/felx/nimbus-jose-jwt purl2cpe 2026-10-12 21:11:59.842069
pkg:github/gesellix/nimbus-jose-jwt purl2cpe 2026-10-12 21:11:59.842072
pkg:maven/com.nimbusds/nimbus-jose-jwt purl2cpe 2026-10-12 21:11:59.842076

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2025-53864 vulnerable 2026-06-08 07:31:15.870650 Details available
MEDIUM (5.8)
Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.
Published: 2025-07-11T00:00:00.000Z
Updated: 2025-09-23T18:38:15.547Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open JSON directly

Open this panel to browse, search, copy or download the JSON record.