connect2id vulnerabilities

Products

• nimbus jose+jwt 6

Latest connect2id CVEs

Newest publication first

1. CVE-2025-53864 Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON

   Published 2025-07-11

   Medium·CVSS 5.8 EPSS 0.98%

   Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue beca...

2. CVE-2023-52428 Denial of Service in Connect2id Nimbus JOSE+JWT

   Published 2024-02-11

   High·CVSS 7.5 EPSS 0.81%

   In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.

3. CVE-2019-17195 Improper Check for Unusual or Exceptional Conditions in Connect2id Nimbus JOSE+JWT

   Published 2019-10-15

   Critical·CVSS 9.8 EPSS 11.1%

   Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.

4. CVE-2017-12973 Nimbus JOSE+JWT vulnerable to padding oracle attack

   Published 2017-08-20

   Low·CVSS 3.1 EPSS 0.64%

   Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attackers to conduct a padding oracle attack.

5. CVE-2017-12972 Nimbus JOSE+JWT missing overflow check

   Published 2017-08-20

   High·CVSS 7.5 EPSS 0.89%

   In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length values from bytes to bits, which allows attackers to conduct HMAC bypass attacks by shifting Additional Authenticated Data (AAD) and ciphertext so that different plaintext is obtained for th...

6. CVE-2017-12974 Improper Verification of Cryptographic Signature in Nimbus JOSE+JWT

   Published 2017-08-20

   High·CVSS 7.5 EPSS 1.3%

   Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows attackers to conduct an Invalid Curve Attack in environments where the JCE provider lacks the applicable curve validation.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.