Bug 2379485 (CVE-2025-53864)

Summary:	CVE-2025-53864 com.nimbusds/nimbus-jose-jwt: Uncontrolled recursion in Connect2id Nimbus JOSE + JWT
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aazores, abrianik, anstephe, aprice, asoldano, ataylor, avibelli, bbaranow, bgeorges, bmaxwell, brian.stansberry, caswilli, cdewolf, chfoley, clement.escoffier, cmah, dandread, darran.lofthouse, dbruscin, dkreling, dnakabaa, dosoudil, eaguilar, ebaron, eric.wittmann, fjuma, fmariani, fmongiar, ggrzybek, gmalinko, gsmet, istudens, ivassile, iweiss, janstey, jcantril, jmartisk, jnethert, jolong, jpoth, jsamir, jscholz, kaycoth, kholdawa, kvanderr, lcouzens, lgao, lthon, manderse, mosmerov, mskarbek, msochure, msvehla, nipatil, nwallace, oezr, olubyans, pantinor, parichar, pdelbell, periklis, pesilva, pgallagh, pjindal, pmackay, probinso, rguimara, rkubis, rojacob, rruss, rstancel, rstepani, rsvoboda, sbiarozk, smaestri, swoodman, tasato, tcunning, tom.jenkinson, tqvarnst, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A denial of service flaw has been discovered in Connect2id Nimbus JOSE + JWT. This issue can allow a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-07-11 03:01:12 UTC

Connect2id Nimbus JOSE + JWT before 10.0.2 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.

Comment 2 errata-xmlrpc 2025-08-01 17:43:40 UTC

This issue has been addressed in the following products:

  Streams for Apache Kafka 3.0.0

Via RHSA-2025:12511 https://access.redhat.com/errata/RHSA-2025:12511