
Cloud Vulnerability DB
A community-led vulnerabilities database
Connect2id Nimbus JOSE + JWT before version 10.0.2 contains a denial of service vulnerability that allows remote attackers to cause application disruption through deeply nested JSON objects in JWT claim sets. The vulnerability was discovered in July 2025 and is tracked as CVE-2025-53864. The issue affects all versions of the library prior to 10.0.2 (NVD).
The vulnerability stems from uncontrolled recursion when processing deeply nested JSON objects within JWT claim sets. The issue is independent of the Gson 2.11.0 library, as Connect2id could have implemented its own JSON object nesting depth validation. The vulnerability has been assigned a CVSS v3.1 base score of 5.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L, indicating network accessibility with low attack complexity and no required privileges or user interaction (NVD, Snyk).
When exploited, this vulnerability can lead to denial of service conditions through stack overflow errors caused by processing deeply nested JSON structures. The impact is primarily on service availability, with no direct effect on confidentiality or integrity of the system (Miggo).
The recommended mitigation is to upgrade to Nimbus JOSE + JWT version 10.0.2 or later, which includes fixes for this vulnerability. The patch implements proper validation of JSON object nesting depth to prevent stack overflow conditions (NVD).
Source: This report was generated using AI
Free Vulnerability Assessment
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
"We know that if Wiz identifies something as critical, it actually is."