CVE-2025-53864

🗓️ 11 Jul 2025 00:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 157 Views

CVE-2025-53864 in Connect2id Nimbus JOSE + JWT allows denial of service via nested JSON objects.

Reporter	Title	Published	Views	Family All 78
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in Connect2id Nimbus JOSE + JWT (CVE-2025-53864)	7 Nov 202514:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Datapower Operations Dashboard could allow a remote attacker to cause a denial of service CVE-2025-53864	8 Dec 202515:13	–	ibm
IBM Security Bulletins	Security Bulletin: DevOps Test Performance contains a vulnerability related to use of the Connect2id Nimbus JOSE + JWT library	16 Apr 202614:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerability fixes in IBM webMethods Managed File Transfer On-Prem	22 Dec 202513:43	–	ibm
IBM Security Bulletins	Security Bulletin: EDB PGAI Hybrid Management with IBM is affected by Multiple Vulnerabilities.	6 May 202615:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM watsonx Orchestrate Developer Edition affected by vulnerability in nimbus-jose-jwt	30 Oct 202507:13	–	ibm
IBM Security Bulletins	Security Bulletin: Common vulnerabilities addressed in Cloudera Observability 3.6.2	9 Mar 202617:07	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data	16 Dec 202511:07	–	ibm
IBM Security Bulletins	Security Bulletin:Multiple Vulnerabilities in IBM Event Endpoint Management	2 Dec 202511:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Lifecycle Management - Jazz Foundation is impacted by vulnerabilities in Nimbus JOSE+JWT	27 Jan 202607:00	–	ibm

Vulners

CNA

Node

connect2id nimbus_jose+jwtRange0–10.0.2

[
  {
    "defaultStatus": "unaffected",
    "product": "Nimbus JOSE+JWT",
    "vendor": "Connect2id",
    "versions": [
      {
        "lessThan": "10.0.2",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
bitbucket	www.bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested
github	www.github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0
bitbucket	www.bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch
bitbucket	www.bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c
github	www.github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b

15 Apr 2026 00:35Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.15.8

EPSS0.00143

SSVC

CWE-674