5.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-53864

CVE-2025-53864: Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON

Connect2id Nimbus JOSE + JWT before 10.0.2 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-53864

CVE-2025-53864:

5.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
com.nimbusds:nimbus-jose-jwt	maven	< 10.0.2	10.0.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the parsing of deeply nested JSON objects within a JWT claim set, leading to a denial of service due to uncontrolled recursion. While the original source code for the patch was not directly accessible, the analysis of a similar vulnerability in the google/gson library, which is used by nimbus-jose-jwt, provided strong evidence for the nature of the vulnerability and the likely fix. The gson patch introduced a nesting limit to its JsonReader to prevent StackOverflowError. The vulnerability description for nimbus-jose-jwt explicitly states that the issue is independent of the gson issue, implying that nimbus-jose-jwt had its own responsibility to validate the nesting depth. The most logical place for this vulnerability to exist is in the code responsible for parsing the JWT claims. In the nimbus-jose-jwt library, this is handled by the com.nimbusds.jwt.JWTClaimsSet.parse method. An attacker could craft a JWT with a deeply nested JSON in the claims, which, when parsed by the vulnerable parse method, would lead to excessive recursion and a stack overflow, thus causing a denial of service. The confidence in this finding is medium, as it is based on strong inference from the vulnerability description and analysis of a related patch, rather than direct observation of the source code.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.