CVE-2025-53864 Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON
Remote attackers can cause denial of service in Connect2id Nimbus JOSE+JWT by sending deeply nested JSON objects in JWT claims.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-53864?
CVE-2025-53864 is a medium-severity denial of service vulnerability in Connect2id Nimbus JOSE+JWT, published on 11 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.
Weakness: CWE-674
Which versions are affected by CVE-2025-53864?
4 open source packages ship an affected version, including com.nimbusds:nimbus-jose-jwt.
| Package | Affected | Fixed in |
|---|---|---|
com.nimbusds:nimbus-jose-jwt Maven | All versions | 9.37.4 |
com.nimbusds:nimbus-jose-jwt Maven | All versions | 9.37.4 |
com.nimbusds:nimbus-jose-jwt Maven | From 9.38-rc1 | 10.0.2 |
com.nimbusds:nimbus-jose-jwt Maven | From 9.38-rc1 | 10.0.2 |
How do I fix CVE-2025-53864?
Upgrade com.nimbusds:nimbus-jose-jwt to a fixed version for your release line: 9.37.4 or 10.0.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-53864 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53864 exists.
Sources
Also known as CLEANSTART-2026-AM99343, CLEANSTART-2026-FI29300, CLEANSTART-2026-TS87996, CLSA-2025-1760918790, CLSA-2025-1762474006, CLSA-2026-1769990936 and 21 more.