🛡️ CVE-2025-53864 — nimbus-jose-jwt

🟡 CVSS 5.8 — Medium ✅ No Known Exploit CWE-674 NVD

5.8

CVSS Score

0 Low4 Medium7 High9 Critical10

Description

Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON

Connect2id Nimbus JOSE + JWT before 10.0.2 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.

How this vulnerability can be exploited

This issue can be reached over the network, attack complexity is low, an attacker needs no privileges on the target. No user interaction is required. The scope is changed, meaning a successful attack can affect components beyond the vulnerable one. Rated impact: confidentiality none, integrity none, availability low.

Weakness class

CVE-2025-53864 is classified as CWE-674: Uncontrolled Recursion. The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Affected software

CVE-2025-53864 is recorded against 2 packages.

com.nimbusds:nimbus-jose-jwt (fixed in 9.37.4)
unknown

Timeline and source

Published on 11 July 2025 and last revised on 4 February 2026. No public exploit is currently recorded for this entry. Record sourced from NVD.

References

nvd.nist.gov (Advisory)
github.com (Web)
bitbucket.org (Package)
bitbucket.org (Web)
bitbucket.org (Web)
bitbucket.org (Web)
github.com (Web)

CVE-2025-53864 on other distributions

Each distribution ships its own build and its own fixed version. Pick the one you run:

Ubuntu

Details

Severity Medium

CVSS Score 5.8

CVSS Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

CWE CWE-674

Public Exploit ✅ No

Source NVD

Published 2025-07-11

Updated 2026-08-12

Modified 2026-02-04

Fix URL N/A

Affected Packages

Software	From version	Fixed in
com.nimbusds:nimbus-jose-jwt	—	9.37.4
unknown	—	—

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-53864

WEB https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b

PACKAGE https://bitbucket.org/connect2id/nimbus-jose-jwt

WEB https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c

WEB https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested

WEB https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch

WEB https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0

🔗 NVD 🔗 Mitre

Similar Threats

Vulnerability Monitoring

Track new vulnerabilities in nimbus-jose-jwt

CVE-2025-53864 is rated CVSS 5.8 Medium. BotEraser monitors your WordPress installation and notifies you when software you use appears in our vulnerability database.

Set Up Free Alerts →

No credit card required · Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.