Denial of Service Vulnerability in Connect2id Nimbus JOSE + JWT

CVE-2025-53864

What is CVE-2025-53864?

A vulnerability in Connect2id's Nimbus JOSE + JWT library allows remote attackers to exploit a denial of service scenario by submitting deeply nested JSON objects within a JWT claim set. The flaw stems from uncontrolled recursion, which can lead to a stack overflow. It is important to note that the vulnerability does not rely on the Gson library limitations, as the potential for deep nesting could have been mitigated by implementing checks in the Nimbus library itself.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References