Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2025-53864 · ADVISORY
• google/gson commit 1039427 · WEB
• bitbucket.org/connect2id/nimbus-jose-jwt · PACKAGE
• bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c · WEB
• bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested · WEB
• bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch · WEB
• google/gson · WEB

Lỗ hổng khác của com.nimbusds:nimbus-jose-jwt

• CVE-2023-52428CAO 7.5In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header val…
• CVE-2019-17195NGHIÊM TRỌNG 9.8Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash…
• CVE-2017-12974CAO 7.5Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve…
• CVE-2017-12973THẤP 3.1Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attacke…
• CVE-2017-12972CAO 7.5In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows attackers …