Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 38793419 for version 14.1.1.0.0.Apply the Patch Set Update (PSU) 38792523 for version 12.2.1.4.0.Apply the Patch Set Update (PSU) 38792753 for version 14.1.2.0.0. | Jan 23, 2026 | Jul 11, 2025 |
| Red Hat Jboss Eap | — | — | Jul 14, 2025 | Jul 11, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub