# CVE-2025-53864: Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON

> CVE-2025-53864 (GitHub advisory GHSA-xwmg-2g98-w7v9) is a medium-severity vulnerability with a CVSS 3.1 base score of 5.8, classed as Uncontrolled Recursion (CWE-674), in com.nimbusds:nimbus-jose-jwt (Maven). Affected versions: < 9.37.4; >= 9.38-rc1, < 10.0.2. It is fixed in 10.0.2 or 9.37.4, depending on the release line.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2025-53864

| Field | Value |
| --- | --- |
| CVE | CVE-2025-53864 |
| GHSA | GHSA-xwmg-2g98-w7v9 |
| Severity | Medium |
| CVSS 3.1 | 5.8 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L` (GitHub Advisory Database) |
| CWE | CWE-674 Uncontrolled Recursion |
| EPSS | 0.84% (higher than 56% of CVEs) |
| CISA KEV | Not listed |
| SSVC | exploitation poc, automatable yes, technical impact partial |
| Published | 11 Jul 2025 |
| Modified | 23 Sept 2025 |

## Description

Connect2id Nimbus JOSE + JWT before 10.0.2 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| com.nimbusds:nimbus-jose-jwt | Maven | `pkg:maven/com.nimbusds/nimbus-jose-jwt` | < 9.37.4; >= 9.38-rc1, < 10.0.2 | 10.0.2, 9.37.4 |

## Fix commits

- Patch: https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b
- Patch: https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c
- Release: https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/d245d7a32003b6ca247d80fc33da7c009b278c22 (10.0.2)
- Release: https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/392252c7a8f2e0c089f6537be32c440ea4e32ed1 (9.37.4)

## Questions

**What is the GHSA ID for CVE-2025-53864?**

GitHub tracks CVE-2025-53864 as GHSA-xwmg-2g98-w7v9.

**What is the CVSS score of CVE-2025-53864?**

CVE-2025-53864 has a CVSS 3.1 base score of 5.8 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L.

**Which versions are affected by CVE-2025-53864?**

com.nimbusds:nimbus-jose-jwt (Maven): < 9.37.4; >= 9.38-rc1, < 10.0.2.

**How do I fix CVE-2025-53864?**

Upgrade to 10.0.2 or 9.37.4, depending on the release line. The fix is in commits 1039427 and f7fb882.

**What is the Package URL (PURL) for CVE-2025-53864?**

The affected package's PURL is pkg:maven/com.nimbusds/nimbus-jose-jwt.

**Is CVE-2025-53864 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2025-53864. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "poc". EPSS estimates a 0.84% chance of exploitation in the next 30 days, higher than 56% of CVEs.

## References

- https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b (fix)
- https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c (fix)
- https://nvd.nist.gov/vuln/detail/CVE-2025-53864 (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53864.json (advisory)
- https://github.com/advisories/GHSA-xwmg-2g98-w7v9 (advisory)
- https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested (report)
- https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch (report)
- https://bitbucket.org/connect2id/nimbus-jose-jwt (package)
- https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2025-53864), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.