Connect2id
4 CVEs across 2 Connect2id products. Browse Connect2id vulnerabilities, severities, and proof-of-concept exploits.
Connect2id products with known CVEs
Connect2id CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2025-53864 | Medium | 5.8 | 2025-07-11 | Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON objec… |
CVE-2023-52428 | High | 7.5 | 2024-02-11 | In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration c… |
CVE-2019-17195 | Critical | 9.8 | 2019-10-15 | Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential informa… |
CVE-2017-12974 | High | 7.5 | 2017-08-20 | Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows atta… |
CVE-2017-12973 | Low | 3.1 | 2017-08-20 | Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attackers to conduct a pad… |
CVE-2017-12972 | High | 7.5 | 2017-08-20 | In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows attackers to conduct HMAC byp… |