Skip to content
OpenAdvisories
Medium · 5.8 CVE-2025-53864 EUVD-2025-21099GHSA-xwmg-2g98-w7v9

Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON

Published Jul 11, 2025 · Updated Sep 23, 2025 · Assigned by mitre

Vendor: Connect2id Product: Nimbus JOSE+JWT Package: akhq Package: apache-nifi Package: apache-nifi-compat Package: apache-nifi-registry Package: apache-nifi-registry-toolkit Package: apache-nifi-toolkit Package: apicurio-registry Package: apicurio-registry-nginx-config Package: apicurio-registry-ui Package: celeborn-0.6 Package: com.nimbusds:nimbus-jose-jwt Package: dependency-track Package: dependency-track-bundled Package: druid Package: flyway Package: libgoogle-gson-java Package: logstash-8-with-output-opensearch Package: spark-4.0-scala-2.13 Package: spark-4.1 Package: spark-4.1-scala-2.13 Package: tez Package: wildfly Package: wildfly-openjdk-17 Package: wildfly-openjdk-17-compat Package: wildfly-openjdk-21 Package: wildfly-openjdk-21-compat Ecosystem: Maven Ecosystem: Ubuntu Ecosystem: Wolfi

Description

Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.

Affected products

VendorProductAffectedFixed
Connect2id Nimbus JOSE+JWT < 10.0.2 10.0.2

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 libgoogle-gson-java No fix yet —
Ubuntu 26.04 LTS libgoogle-gson-java No fix yet —
Ubuntu 25.10 libgoogle-gson-java No fix yet —
Ubuntu 24.04 LTS libgoogle-gson-java No fix yet —
Ubuntu 22.04 LTS libgoogle-gson-java No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS libgoogle-gson-java No fix yet —
Ubuntu Pro 18.04 LTS libgoogle-gson-java No fix yet —
Ubuntu Pro 16.04 LTS libgoogle-gson-java No fix yet —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling akhq 0.26.0-r0 —
Wolfi rolling apache-nifi +2 2.4.0-r6 —
Wolfi rolling apache-nifi-registry +1 2.4.0-r4 —
Wolfi rolling apicurio-registry +2 3.0.9-r6 —
Wolfi rolling celeborn-0.6 +1 No fix yet —
Wolfi rolling dependency-track +1 4.14.2-r4 —
Wolfi rolling druid 37.0.0-r14 —
Wolfi rolling flyway 11.16.0-r0 —
Wolfi rolling spark-4.0-scala-2.13 4.0.3-r2 —
Wolfi rolling spark-4.1 4.1.0-r1 —
Wolfi rolling spark-4.1-scala-2.13 4.1.2-r5 —
Wolfi rolling tez 0.10.5-r3 —
Wolfi rolling wildfly +4 36.0.1-r6 —

Affected packages

EcosystemPackageAffectedFixedRecord
Maven com.nimbusds:nimbus-jose-jwt >= 9.38-rc1, < 10.0.2 10.0.2 GHSA-xwmg-2g98-w7v9
Maven com.nimbusds:nimbus-jose-jwt < 9.37.4 9.37.4 GHSA-xwmg-2g98-w7v9

Advisories 12

References