CVE-2019-17195
Critical · 9.8CVSS
9.8
EPSS
11.1%
Published
Oct 15, 2019
CISA due date
—
The record
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Maven | com.nimbusds:nimbus-jose-jwt | 0 | 7.9 |
| Red Hat:enterprise_linux:7::hypervisor | apache-commons-beanutils | 0 | 0:1.8.3-15.el7_7 |
| Red Hat:enterprise_linux:7::hypervisor | apache-commons-beanutils-javadoc | 0 | 0:1.8.3-15.el7_7 |
| Red Hat:rhev_manager:4.3 | ovirt-engine | 0 | 0:4.3.9.3-0.1.el7 |
| Red Hat:rhev_manager:4.3 | ovirt-engine-backend | 0 | 0:4.3.9.3-0.1.el7 |
| Red Hat:rhev_manager:4.3 | ovirt-engine-dbscripts | 0 | 0:4.3.9.3-0.1.el7 |
| Red Hat:rhev_manager:4.3 | ovirt-engine-extension-aaa-misc | 0 | 0:1.0.4-1.el7ev |
| Red Hat:rhev_manager:4.3 | ovirt-engine-extensions-api-impl | 0 | 0:4.3.9.3-0.1.el7 |
| Red Hat:rhev_manager:4.3 | ovirt-engine-extensions-api-impl-javadoc | 0 | 0:4.3.9.3-0.1.el7 |
| Red Hat:rhev_manager:4.3 | ovirt-engine-health-check-bundler | 0 | 0:4.3.9.3-0.1.el7 |
| Red Hat:rhev_manager:4.3 | ovirt-engine-restapi | 0 | 0:4.3.9.3-0.1.el7 |
| Red Hat:rhev_manager:4.3 | ovirt-engine-setup | 0 | 0:4.3.9.3-0.1.el7 |
| Red Hat:rhev_manager:4.3 | ovirt-engine-setup-base | 0 | 0:4.3.9.3-0.1.el7 |
| Red Hat:rhev_manager:4.3 | ovirt-engine-setup-plugin-cinderlib | 0 | 0:4.3.9.3-0.1.el7 |
| Red Hat:rhev_manager:4.3 | ovirt-engine-setup-plugin-ovirt-engine | 0 | 0:4.3.9.3-0.1.el7 |
| Red Hat:rhev_manager:4.3 | ovirt-engine-setup-plugin-ovirt-engine-common | 0 | 0:4.3.9.3-0.1.el7 |
| Red Hat:rhev_manager:4.3 | ovirt-engine-setup-plugin-vmconsole-proxy-helper | 0 | 0:4.3.9.3-0.1.el7 |
| Red Hat:rhev_manager:4.3 | ovirt-engine-setup-plugin-websocket-proxy | 0 | 0:4.3.9.3-0.1.el7 |
| Red Hat:rhev_manager:4.3 | ovirt-engine-tools | 0 | 0:4.3.9.3-0.1.el7 |
| Red Hat:rhev_manager:4.3 | ovirt-engine-tools-backup | 0 | 0:4.3.9.3-0.1.el7 |
| Red Hat:rhev_manager:4.3 | ovirt-engine-vmconsole-proxy-helper | 0 | 0:4.3.9.3-0.1.el7 |
| Red Hat:rhev_manager:4.3 | ovirt-engine-webadmin-portal | 0 | 0:4.3.9.3-0.1.el7 |
| Red Hat:rhev_manager:4.3 | ovirt-engine-websocket-proxy | 0 | 0:4.3.9.3-0.1.el7 |
| Red Hat:rhev_manager:4.3 | ovirt-fast-forward-upgrade | 0 | 0:1.0.0-17.el7ev |
| Red Hat:rhev_manager:4.3 | python2-ovirt-engine-lib | 0 | 0:4.3.9.3-0.1.el7 |
| Red Hat:rhev_manager:4.3 | rhvm | 0 | 0:4.3.9.3-0.1.el7 |
| Red Hat:rhev_manager:4.3 | rhvm-dependencies | 0 | 0:4.3.2-1.el7ev |
Related vulnerabilities
- CVE-2025-53864 Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a… Also affects com.nimbusds:nimbus-jose-jwt
- CVE-2023-52428 In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service… Also affects com.nimbusds:nimbus-jose-jwt
- CVE-2026-109618 PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort… CWE-755
- CVE-2026-109619 PHP has various global state that temporarily points into request memory. CWE-755
- CVE-2026-105757 vLLM is an inference and serving engine for large language models. CWE-755
- CVE-2026-102274 PyJWT is a Python implementation of JSON Web Token standards. CWE-755
- CVE-2026-49305 Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful… CWE-755
- CVE-2026-45819 baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on… CWE-755