Vulnerability in Connect2id Nimbus Jose+jwt
CVE-2025-53864
Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.
EPSS: 0.008 (53.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L.
Affected products
- Connect2id Nimbus Jose+jwt — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2025-53864?
- CVE-2025-53864 is a medium-severity vulnerability in Connect2id Nimbus Jose+jwt, classified under Uncontrolled Recursion. CVSS score: 5.8/10. Published 2025-07-11.
- How severe is CVE-2025-53864?
- Medium severity. CVSS v3 base score is 5.8 out of 10.
- Is CVE-2025-53864 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.