Security Advisory

CVE-2025-53864

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2025-07-11 00:00:00

Last updated 2025-09-23 18:38:15

Assigner mitre

State PUBLISHED

Description

Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.

← Browse all CVEs View on cve.org ↗