Denial of Service in Connect2id Nimbus JOSE+JWT

Description

References

• nvd.nist.gov/vuln/detail/CVE-2023-52428 · ADVISORY
• bitbucket.org/connect2id/nimbus-jose-jwt · PACKAGE
• bitbucket.org/connect2id/nimbus-jose-jwt/commits/3b3b77e · WEB
• bitbucket.org/connect2id/nimbus-jose-jwt/issues/526 · WEB
• connect2id.com/products/nimbus-jose-jwt · WEB
• bitbucket.org/connect2id/nimbus-jose-jwt/issues/526 · Issue Tracking

More vulnerabilities in com.nimbusds:nimbus-jose-jwt

• CVE-2025-53864MEDIUM 5.8Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deepl…
• CVE-2019-17195CRITICAL 9.8Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash…
• CVE-2017-12974HIGH 7.5Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve…
• CVE-2017-12973LOW 3.1Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attacke…
• CVE-2017-12972HIGH 7.5In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows attackers …