CVE-2025-53864

Name of the Vulnerable Software and Affected Versions: Connect2id Nimbus JOSE + JWT versions prior to 10.0.2

Description: The software is susceptible to a denial-of-service condition triggered by a deeply nested JSON object within a JWT claim set. This occurs due to uncontrolled recursion during JSON object processing. The issue is independent of a separate problem related to Gson 2.11.0, as the Connect2id product had the capability to validate JSON object nesting depth regardless of any limits imposed by Gson.

Recommendations: Update Connect2id Nimbus JOSE + JWT to version 10.0.2 or later.