Denial of Service Vulnerability in Connect2id Nimbus JOSE + JWT

CVE-2025-53864

What is CVE-2025-53864?

A vulnerability in Connect2id's Nimbus JOSE + JWT library allows remote attackers to exploit a denial of service scenario by submitting deeply nested JSON objects within a JWT claim set. The flaw stems from uncontrolled recursion, which can lead to a stack overflow. It is important to note that the vulnerability does not rely on the Gson library limitations, as the potential for deep nesting could have been mitigated by implementing checks in the Nimbus library itself.

References