CVE-2025-53864: 
Java vulnerability analysis and mitigation

CVE-2025-53864 is a denial-of-service vulnerability in Connect2id Nimbus JOSE+JWT caused by uncontrolled recursion when processing deeply nested JSON objects in JWT claim sets. It affects versions 10.0.x before 10.0.2 and 9.37.x before 9.37.4 of the com.nimbusds:nimbus-jose-jwt Maven package. The vulnerability was published on July 11, 2025, and carries a CVSS v3.1 base score of 5.8 (Medium) with a Changed scope, reflecting potential impact beyond the vulnerable component (Github Advisory, Red Hat Bugzilla). Downstream products from Oracle, IBM, Splunk, and others have also been identified as affected due to their dependency on this library (Oracle CPU Oct 2025).

The root cause is CWE-674 (Uncontrolled Recursion): the library fails to enforce a maximum nesting depth when parsing JSON objects within JWT claim sets, allowing recursive processing to exhaust the JVM stack and trigger a StackOverflowError. The vulnerability is independent of the Gson 2.11.0 nesting issue — Nimbus JOSE+JWT could have implemented its own depth check regardless of any limits imposed by the underlying Gson library, but did not do so prior to the fix (Github Advisory). An attacker exploits this by crafting a JWT with a claim set containing a JSON object nested to an extreme depth (e.g., thousands of levels) and submitting it to any endpoint that parses JWTs using the vulnerable library. No authentication or special privileges are required. The Gson fix (commit 1039427) added a configurable nesting limit (default 255) to JsonReader, which informed the approach taken in the Nimbus JOSE+JWT patch (Gson Commit).

Successful exploitation causes a denial of service by crashing or hanging the affected service through a StackOverflowError, making it unavailable to legitimate users. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Because the scope is marked as Changed, the crash may affect components beyond the directly vulnerable library, such as the broader application server or dependent services (Github Advisory). Affected downstream products include Oracle Essbase, IBM Guardium Data Security Center, IBM Instana Observability, IBM Db2 Warehouse on Cloud Pak for Data, Splunk AppDynamics, and others (Oracle CPU Oct 2025, Red Hat Bugzilla).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is unauthenticated and remotely exploitable with low attack complexity, making it straightforward to attempt once the attack pattern is understood. The EPSS score is approximately 0.095–0.143%, placing it in the 34th percentile for exploitation likelihood within 30 days (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Reconnaissance: Identify services that accept and parse JWTs using the Nimbus JOSE+JWT library (versions < 9.37.4 or 10.0.x < 10.0.2), such as OAuth2/OIDC endpoints, API gateways, or authentication services.
2. Craft malicious JWT: Construct a JWT with a claim set containing a deeply nested JSON object — for example, a JSON structure with thousands of levels of nesting (e.g., {"a":{"a":{"a": ... null ...}}}). The nesting depth must exceed the JVM stack capacity to trigger a StackOverflowError.
3. Encode the JWT: Base64url-encode the crafted payload as the JWT claims section. The signature can be omitted or forged depending on whether the target validates signatures before parsing claims.
4. Submit to target: Send the crafted JWT to the vulnerable endpoint via an HTTP request (e.g., as a Bearer token in the Authorization header, or in a POST body).
5. Trigger DoS: The library recursively processes the nested JSON without a depth limit, causing a StackOverflowError that crashes or hangs the service thread, resulting in denial of service (Github Advisory, Red Hat Bugzilla).

• Logs: Java application logs showing java.lang.StackOverflowError originating from Nimbus JOSE+JWT JSON parsing code (e.g., stack traces referencing com.nimbusds.jose or com.nimbusds.jwt classes); repeated errors in short succession from the same source IP.
• Network: Unusual HTTP requests to JWT-consuming endpoints (e.g., /token, /authorize, /api/*) with abnormally large payload sizes in the Authorization header or request body; requests from unexpected or repeated source IPs.
• Application Behavior: Sudden service crashes, thread hangs, or increased error rates on authentication or API endpoints; JVM process restarts or out-of-memory/stack-overflow events logged by the application server.
• Monitoring: Spike in 500-series HTTP error responses from JWT-processing endpoints coinciding with large inbound request payloads.

Upgrade Connect2id Nimbus JOSE+JWT to version 9.37.4 (for the 9.37.x branch) or 10.0.2 (for the 10.0.x branch), which introduce JSON nesting depth limits to prevent uncontrolled recursion (Github Advisory). Red Hat addressed this in Streams for Apache Kafka 3.0.0 via RHSA-2025:12511, and Oracle patched affected products in the October 2025 Critical Patch Update (Red Hat Bugzilla, Oracle CPU Oct 2025). As a workaround prior to patching, consider implementing input validation at the application layer to reject JWTs with abnormally large claim set payloads, or deploy a WAF rule to limit JWT payload size. Organizations using IBM, Splunk, or other downstream products should apply vendor-specific patches as they become available.

Red Hat tracked the vulnerability via Bugzilla and released a fix for Streams for Apache Kafka (RHSA-2025:12511) in August 2025, with 77 users CC'd on the bug report indicating broad internal concern (Red Hat Bugzilla). Oracle included a patch in its October 2025 Critical Patch Update for Oracle Essbase (Oracle CPU Oct 2025). IBM issued multiple security bulletins addressing the vulnerability across Instana, Guardium, Db2 Warehouse, and Cloudera-based products. No significant public researcher commentary or social media discussion has been identified beyond standard vulnerability tracking.