{"action":"Upgrade com.nimbusds:nimbus-jose-jwt to 9.37.4 (9.x) or 10.0.2 (10.x) or later.","affected":[{"fixed":"10.0.2","introduced":"9.38-rc1"},{"fixed":"9.37.4","introduced":"0"}],"component":"com.nimbusds:nimbus-jose-jwt","cve_ids":["CVE-2025-53864"],"ecosystem":"Maven","epss":0.00981,"exploited":false,"fixed_versions":["10.0.2","9.37.4"],"ghsa_id":"GHSA-xwmg-2g98-w7v9","id":"tcs_01M5N9K47S0955CZMEWFWE1RWA","modified_at":"2026-09-10T03:50:26.435456269Z","published_at":"2025-07-11T03:30:34Z","references":["https://osv.dev/vulnerability/GHSA-xwmg-2g98-w7v9","https://nvd.nist.gov/vuln/detail/CVE-2025-53864","https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b","https://bitbucket.org/connect2id/nimbus-jose-jwt","https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested","https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch","https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0"],"severity":{"label":"medium","score":5.8},"sources":[{"source":"osv","source_id":"GHSA-xwmg-2g98-w7v9","url":"https://osv.dev/vulnerability/GHSA-xwmg-2g98-w7v9"}],"summary":"Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON"}