CVE-2025-53864
Java vulnerability analysis and mitigation

Overview

Connect2id Nimbus JOSE + JWT before version 10.0.2 contains a denial of service vulnerability that allows remote attackers to cause application disruption through deeply nested JSON objects in JWT claim sets. The vulnerability was discovered in July 2025 and is tracked as CVE-2025-53864. The issue affects all versions of the library prior to 10.0.2 (NVD).

Technical details

The vulnerability stems from uncontrolled recursion when processing deeply nested JSON objects within JWT claim sets. The issue is independent of the Gson 2.11.0 library, as Connect2id could have implemented its own JSON object nesting depth validation. The vulnerability has been assigned a CVSS v3.1 base score of 5.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L, indicating network accessibility with low attack complexity and no required privileges or user interaction (NVD, Snyk).

Impact

When exploited, this vulnerability can lead to denial of service conditions through stack overflow errors caused by processing deeply nested JSON structures. The impact is primarily on service availability, with no direct effect on confidentiality or integrity of the system (Miggo).

Mitigation and workarounds

The recommended mitigation is to upgrade to Nimbus JOSE + JWT version 10.0.2 or later, which includes fixes for this vulnerability. The patch implements proper validation of JSON object nesting depth to prevent stack overflow conditions (NVD).

Additional resources


SourceThis report was generated using AI

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management