Skip to content
CVE IDCVE-2025-53864GitHub advisory IDGHSA-xwmg-2g98-w7v9

Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON

CVE-2025-53864 (GitHub advisory GHSA-xwmg-2g98-w7v9) is a medium-severity vulnerability with a CVSS 3.1 base score of 5.8, classed as Uncontrolled Recursion (CWE-674), in com.nimbusds:nimbus-jose-jwt (Maven). Affected versions: < 9.37.4; >= 9.38-rc1, < 10.0.2. It is fixed in 10.0.2 or 9.37.4, depending on the release line.

Medium5.8Fix availableGitHub reviewed

Published 11 Jul 2025Updated 23 Sept 2025

5.8MediumCVSS 3.1
CVE ID
CVE-2025-53864
GHSA ID
GHSA-xwmg-2g98-w7v9
EPSS
0.84%higher than 56% of CVEs
Weakness (CWE)
KEV status
Not in KEV
Published
11 Jul 2025
Updated
23 Sept 2025
Ecosystem
  • Maven
Assigned by (CNA)
mitre

Summary

Source: OSV (GitHub advisory)

Connect2id Nimbus JOSE + JWT before 10.0.2 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.

Technical details

Source: GitHub Advisory Database

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Medium5.8Base score from GitHub Advisory Database

Attack Vector AV
Network
Attack Complexity AC
Low
Privileges Required PR
None
User Interaction UI
None
Scope S
Changed
Confidentiality C
None
Integrity I
None
Availability A
Low

CISA SSVC decision points

Exploitation
poc
Proof-of-concept code is public
Automatable
yes
Attackers can automate this at scale
Technical impact
partial
Limited control of the affected system

CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.

Affected packages

Source: OSV (GitHub advisory)

  • com.nimbusds:nimbus-jose-jwt
    Maven
    pkg:maven/com.nimbusds/nimbus-jose-jwt
    Affected versions
    < 9.37.4
    >= 9.38-rc1, < 10.0.2
    Fixed in
    10.0.2
    9.37.4
    Show 290 listed versions
    • 10.0
    • 10.0.1
    • 9.38
    • 9.38-rc1
    • 9.38-rc3
    • 9.38-rc4
    • 9.38-rc5
    • 9.39
    • 9.39.1
    • 9.39.2
    • 9.39.3
    • 9.40

Fix

Source: OSV (GitHub advisory)

Fix available

Upgrade to 10.0.2 or 9.37.4, depending on your release line.

Patch commits

  • 1039427Patch commitgithub.com/google/gson

    Add nesting limit for `JsonReader` (#2588)

    +228 −32 across 7 files

    • gson/src/main/java/com/google/gson/internal/bind/JsonTreeReader.java+8 −3
    • gson/src/main/java/com/google/gson/stream/JsonReader.java+50 −4
    • gson/src/test/java/com/google/gson/JsonParserTest.java+8 −12
    • gson/src/test/java/com/google/gson/ObjectTypeAdapterTest.java+10 −12
    • gson/src/test/java/com/google/gson/functional/ObjectTest.java+27 −0
    • gson/src/test/java/com/google/gson/internal/bind/JsonTreeReaderTest.java+48 −1
    • gson/src/test/java/com/google/gson/stream/JsonReaderTest.java+77 −0
  • f7fb882Patch commitbitbucket.org/connect2id/nimbus-jose-jwt

Release commits

The commits each fixed release tag points at. They usually bump the version rather than contain the fix itself.

  • d245d7aRelease commit10.0.2bitbucket.org/connect2id/nimbus-jose-jwt
  • 392252cRelease commit9.37.4bitbucket.org/connect2id/nimbus-jose-jwt

Vulnerability intelligence

References

Credits

Questions about CVE-2025-53864

What is the GHSA ID for CVE-2025-53864?
GitHub tracks CVE-2025-53864 as GHSA-xwmg-2g98-w7v9.
What is the CVSS score of CVE-2025-53864?
CVE-2025-53864 has a CVSS 3.1 base score of 5.8 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L.
Which versions are affected by CVE-2025-53864?
com.nimbusds:nimbus-jose-jwt (Maven): < 9.37.4; >= 9.38-rc1, < 10.0.2.
How do I fix CVE-2025-53864?
Upgrade to 10.0.2 or 9.37.4, depending on the release line. The fix is in commits 1039427 and f7fb882.
What is the Package URL (PURL) for CVE-2025-53864?
The affected package's PURL is pkg:maven/com.nimbusds/nimbus-jose-jwt.
Is CVE-2025-53864 exploited in the wild?
CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2025-53864. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "poc". EPSS estimates a 0.84% chance of exploitation in the next 30 days, higher than 56% of CVEs.

Data sources

Upstream records

  • OSV (GitHub advisory)LoadedRaw JSON
  • GitHub Advisory DatabaseLoadedRaw JSON
  • OSV (CVE record)LoadedRaw JSON
  • CVE.orgLoaded
  • CISA KEV catalogLoaded

Fetched 4 days ago (10 Oct 2026, 11:48 UTC). Records refresh automatically after 24 hours.

Where each part of this page came from

Title and description
OSV (GitHub advisory)
Severity score
GitHub Advisory Database
Weakness (CWE)
GitHub Advisory Database
Affected packages
OSV (GitHub advisory)
Fix
OSV (GitHub advisory)
References
Computed by CVEminer
SSVC
CVE.org
KEV status
CISA KEV catalog
EPSS
GitHub Advisory Database

OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.