CVE-2025-53864

What it actually does

The vulnerability allows a remote, unauthenticated attacker to cause a denial of service. It exists in the Connect2id Nimbus JOSE + JWT library, which fails to limit the nesting depth of JSON objects within a JWT claim set. By sending a JWT containing a claim with a deeply nested JSON structure, an attacker can trigger uncontrolled recursion during parsing. This leads to a stack overflow error, which crashes the thread or process handling the request, making the service unavailable.

Why it matters to the business

An attacker can render applications that use this library for authentication or data exchange unavailable to legitimate users. This can lead to service outages, disrupting critical business operations, preventing user access to services, and potentially causing financial and reputational damage. Because the vulnerability can affect components beyond the immediately vulnerable one (as indicated by the CVSS Scope Changed metric), the impact could be widespread, especially if a central authentication service is affected.

How an attack unfolds

A remote, unauthenticated attacker identifies a service endpoint that accepts and parses JWTs using a vulnerable version of the Nimbus JOSE + JWT library. The attacker crafts a malicious JWT containing a claim with a deeply nested JSON object, such as '{"a":{"a":{"a":...}}}' repeated to a great depth. This JWT is then sent to the target application. When the vulnerable library attempts to parse the malicious token, the uncontrolled recursion in the JSON parsing logic consumes all available stack memory, triggering a stack overflow exception. This exception terminates the application thread or process, resulting in a denial of service.

How to fix it

The primary remediation is to upgrade the Connect2id Nimbus JOSE + JWT library to a patched version. For applications using the 10.0.x branch, upgrade to version 10.0.2 or later. For applications using the 9.37.x branch, upgrade to version 9.37.4 or later. If an immediate upgrade is not feasible, consider implementing a Web Application Firewall (WAF) rule to inspect and block incoming JWTs that are abnormally large or appear to have excessive nesting depth as a temporary mitigation.

How to confirm the fix worked

To validate the fix, use a software composition analysis (SCA) tool or manually inspect project dependencies (e.g., pom.xml, build.gradle) to confirm that all instances of the Nimbus JOSE + JWT library have been upgraded to version 10.0.2+ or 9.37.4+. To test the fix, you can create a proof-of-concept JWT with a deeply nested JSON claim and submit it to the application in a non-production environment. A vulnerable system will crash or throw a stack overflow error, while a patched system should handle the malicious token gracefully by rejecting it without crashing.

Typical attack path

1. Attacker identifies a target application that uses a vulnerable version of the Nimbus JOSE + JWT library for token processing.
2. Attacker crafts a malicious JWT containing a claim with a deeply nested JSON object.
3. Attacker sends the malicious JWT to an application endpoint that processes JWTs (e.g., an authentication endpoint).
4. The application's JWT parsing library enters an uncontrolled recursion while processing the nested JSON.
5. The recursion exhausts stack memory, causing a stack overflow error that crashes the application thread or process, leading to a denial of service.

How to detect it

To detect potential exploitation attempts, monitor application logs for stack overflow errors, such as 'java.lang.StackOverflowError', particularly if the stack trace involves JWT or JSON parsing functions from the Nimbus library. Correlate these errors with incoming requests in web server or API gateway logs. A spike in application restarts or crashes, especially if associated with requests from a specific source IP to an authentication endpoint, may indicate a denial-of-service attack leveraging this vulnerability.

• java.lang.StackOverflowError

What your security team should do

• Use software composition analysis (SCA) tools to immediately identify all applications using the Connect2id Nimbus JOSE + JWT library and their versions.
• Prioritize patching for internet-facing systems and critical internal services that rely on this library for authentication or session management.
• Upgrade vulnerable instances to version 10.0.2 or 9.37.4 (or newer), depending on the current version branch.
• If patching is delayed, evaluate the use of a WAF to filter requests with excessively large or complex JWTs as a compensating control.