CVE-2025-53864: connect2id nimbus_jose\+jwt Uncontrolled Recursion
CVSS: 5.8v3.1MediumDeferred
AliasesUBUNTU-CVE-2025-53864CGA-22p2-rrh9-9hj4CGA-2cm5-wgxw-rgq6CGA-2g8x-q9xr-hv43CGA-3gfx-5q6w-m3g5CGA-3hw6-p4vh-fxhfCGA-4m8c-57v5-3fm8CGA-4x4r-2p58-fcmpCGA-4x5h-ccxq-f2p2CGA-55rr-63j4-w2w7CGA-58x2-vrqj-ph99CGA-5gc7-pjpc-v568CGA-5gvg-hmgw-p69rCGA-5wx3-64rp-m4rcCGA-6hcx-242f-gcwcCGA-6vf5-78w8-g95rCGA-6xq3-9h7p-4fgpCGA-7cr2-4337-7f38CGA-8fh9-qxgw-6w4wCGA-8hvj-h28r-wp43CGA-8p82-ww98-fqcxCGA-8vf2-rw29-5r4jCGA-933w-p662-rm6mCGA-c2v4-r4m9-m34pCGA-cgvq-qg9r-8r5wCGA-cr5f-h7xj-6pvxCGA-cx44-fqq7-7j2hCGA-f54q-8xhp-hx5qCGA-ffq4-6355-wwghCGA-fhmm-pg5w-8cf8CGA-fwg3-88px-cp7gCGA-g23x-cpqq-4625CGA-g2j2-gvj5-xpfrCGA-g4ww-m635-j4xhCGA-gjrx-8fr9-8rmmCGA-gqr4-jwm9-75w5CGA-h46q-3xvh-4j78CGA-hc4m-4336-32xwCGA-hj46-q7vg-2qmxCGA-m22v-c78m-6pw2CGA-m75c-2rp9-8cxjCGA-m97p-ggv2-76x9CGA-m9cg-xcxp-x62jCGA-p94j-w2pc-h6f7CGA-pjrp-qrhw-7q92CGA-pp82-jpf9-p6mhCGA-q34c-jcq2-p7p7CGA-qhh7-whfg-7rfmCGA-rpg4-3867-4r89CGA-rwm5-mjm4-q8v2CGA-vx4j-mjhr-jvx9CGA-xxfc-x755-mrppCGA-23r9-xq77-fmcxCGA-3324-h89c-jwg3CGA-3c6p-3854-6pjhCGA-3g53-73fx-3985CGA-4gx5-qf7x-2q4cCGA-4h73-g58c-696hCGA-4jjg-vh2c-rr98CGA-5mfc-x5q8-x8p4CGA-5mx6-45f3-r2jhCGA-5pqr-8wp4-466jCGA-5wwj-qjwx-h258CGA-6gpg-v5fp-7fwwCGA-6wvc-58mj-843rCGA-72gc-w4j4-9pc5CGA-7jx9-8c69-777mCGA-7p92-68hj-4f5xCGA-85x7-c8fx-9gp4CGA-8fqg-q2jq-hg7gCGA-8w4r-qf5w-vph6CGA-c3j2-x27q-47h9CGA-c5jv-62gq-3mqcCGA-c5x4-j4vf-rmh3CGA-cjff-qp25-52xgCGA-crhv-5qf8-j59rCGA-cv6v-2fqr-248cCGA-fj68-4xj4-f2fxCGA-g292-jq3g-qh4qCGA-gcrp-cq2m-66fpCGA-gw3r-xg5w-g4w6CGA-h3xr-h7ww-5wx2CGA-hhj5-j6hj-927gCGA-hqrx-m4cr-r3prCGA-hr29-wx3r-phm2CGA-m4hc-hqw4-mpqhCGA-mhmw-c2hm-c69rCGA-mq2g-97j5-wpwjCGA-p4hv-prwv-wxprCGA-pjj7-j3cx-c7gjGHSA-xwmg-2g98-w7v9CGA-q8mp-7cfp-799qCGA-qjm3-h4mm-6qjwCGA-qp5m-cvwv-j628CGA-r3r9-28q5-qmx5CGA-rjcm-v7fw-5xgpCGA-rrw5-7j76-xq4cCGA-vcvq-x82h-9hf9CGA-w7cg-9gqv-72grCGA-w9gm-x8x8-h7w3CGA-wh73-c8jc-5hm5CGA-wrjp-2v58-9qx9CGA-x6w7-92qp-mf8pCGA-xf4r-pg5p-6v58CGA-xf9r-4xpr-xgvj
Published 11-07-2025Last modified 23-09-2025
Vulnerability summary
CVE-2025-53864 is a medium (CVSS 5.8) Uncontrolled Recursion vulnerability in connect2id nimbus_jose\+jwt. EPSS estimates a 0.98% chance of exploitation in the next 30 days, higher than 61.5% of scored vulnerabilities.
CVSS score
5.8/10
010
Medium · v3.1 (CVE.org)EPSS score
0.98%
0%100%
Low · +0.13 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 6Timeline
- 11-07-2025PublishedVulnerability first disclosed.
- 23-09-2025Last modifiedVulnerability information updated.
Description
Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.
CVSS metrics
6 scores · 6 sources · 1 versionMedium 5.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:LSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated5.8MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
- OSV · WolfiEcosystem advisory · calculated5.8MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
- OSV · ChainguardEcosystem advisory · calculated5.8MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
- OSV · MavenEcosystem advisory · calculated5.8MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
- NVDNIST5.8MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
EPSS trend
Probability
0.98%
Chance of exploitation in the next 30 days
Percentile
62%
Versus all other CVEs
30-day change
+0.13 pp
From 0.85% on 18-09-2026
18-09-202618-10-2026
EPSS score0.98%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard43 products
- akhq< 0.26.0-r0
- apache-nifi< 2.4.0-r6
- apache-nifi-compat< 2.4.0-r6
- apache-nifi-registry< 2.4.0-r4
- apache-nifi-registry-toolkit< 2.4.0-r4
Wolfi24 products
- akhq< 0.26.0-r0
- apache-nifi< 2.4.0-r6
- apache-nifi-compat< 2.4.0-r6
- apache-nifi-registry< 2.4.0-r4
- apache-nifi-registry-toolkit< 2.4.0-r4
Com.nimbusds1 product
- nimbus-jose-jwt≥ 9.38-rc1, < 10.0.2 | < 9.37.4
Connect2id1 product
- nimbus_jose\+jwt< 10.0.2
Ubuntu1 product
- libgoogle-gson-javaAll versions (No fix recorded)
5 vendors · 70 products
