CVE-2025-53864 Details

A denial-of-service vulnerability has been identified in Connect2id Nimbus JOSE + JWT versions prior to 10.0.2. The issue arises when a remote attacker supplies a deeply nested JSON object in a JWT claim set, leading to uncontrolled recursion and a StackOverflowError. This vulnerability is separate from a similar issue in Gson 2.11.0, as the Connect2id library could have implemented its own checks on JSON nesting depth.

Users can update to Connect2id Nimbus JOSE + JWT version 10.0.2 or later, where this vulnerability has been addressed. Additionally, if using Gson, ensure to update to version 2.12.0 or later, where the nesting limit issue has been fixed.