PT-2025-29195 · Connect2Id · Nimbus Jose+Jwt

Marcono1234 · Publicado 2025-07-11 · Atualizado 2026-05-18 · CVE-2025-53864

Positive Technologies (AI Summary) · Pt

CVSS v3.1

5.8

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Nome do Software Vulnerável e Versões Afetadas: Connect2id Nimbus JOSE + JWT versões anteriores à 10.0.2

Descrição: O software está suscetível a uma condição de negação de serviço desencadeada por um objeto JSON profundamente aninhado dentro de um conjunto de claims JWT. Isso ocorre devido à recursão descontrolada durante o processamento do objeto JSON. Esta questão é independente de um problema separado relacionado ao Gson 2.11.0, pois o produto Connect2id possuía a capacidade de validar a profundidade de aninhamento de objetos JSON independentemente de quaisquer limites impostos pelo Gson.

Recomendações: Atualize o Connect2id Nimbus JOSE + JWT para a versão 10.0.2 ou posterior.

Exploit

Correção

DoS

Uncontrolled Recursion

Enumeração de Fraquezas

CWE-674

Identificadores relacionados

CLEANSTART-2026-DD05788

CLEANSTART-2026-GQ14179

CLEANSTART-2026-JU62349

CLEANSTART-2026-KU61465

CLEANSTART-2026-LE11246

CLEANSTART-2026-RN56220

CLEANSTART-2026-SQ91016

CLEANSTART-2026-SV95049

CLEANSTART-2026-VH41554

CLEANSTART-2026-WK99982

CVE-2025-53864

GHSA-XWMG-2G98-W7V9

Produtos afetados

Nimbus Jose+Jwt

Referências · 336

• 🔥 https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested · Exploit
• https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0 · Nota
• https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-DD05788.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SQ91016.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-RN56220.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-VH41554.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SV95049.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-LE11246.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-JU62349.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-WK99982.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KU61465.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-GQ14179.json · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-34454 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-42583 · Nota de Segurança