- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 6 · 1 high, 1 medium
- Registry
- Maven Central
Advisories 6
- CVE-2025-53864Medium 5.8
Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a…
Affected: from 9.38-rc1, fixed in 10.0.2; fixed in 9.37.4.
- CVE-2023-52428High 7.5
In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header…
Affected: fixed in 9.37.2.
- CVE-2019-17195Unrated
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application…
Affected: fixed in 7.9.
- CVE-2017-12974Unrated
Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified…
Affected: fixed in 4.36.
- CVE-2017-12973Unrated
Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows…
Affected: fixed in 4.39.
- CVE-2017-12972Unrated
In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows…
Affected: fixed in 4.39.