{"cve":"CVE-2025-53864","nvd":{"published":"2025-07-11T03:16:03.563","modified":"2026-06-17T09:39:02.917","status":"Deferred","description":"Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","score":5.8},"cwes":["CWE-674"],"references":["https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:04:28.436527499+00:00"},"epss":{"cve":"CVE-2025-53864","score":0.00981,"percentile":0.62259,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-xwmg-2g98-w7v9","url":"https://osv.dev/vulnerability/GHSA-xwmg-2g98-w7v9","summary":"Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON","modified":"2026-09-10T03:50:26.435456269Z","packages":[{"ecosystem":"Maven","name":"com.nimbusds:nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt","ranges":[">=9.38-rc1 <10.0.2"],"fixed":["10.0.2"]},{"ecosystem":"Maven","name":"com.nimbusds:nimbus-jose-jwt","purl":"pkg:maven/com.nimbusds/nimbus-jose-jwt","ranges":["<9.37.4"],"fixed":["9.37.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}