Listen to this Post
Nimbus JOSE + JWT versions before 10.0.2 are vulnerable to a denial-of-service (DoS) attack due to uncontrolled recursion when parsing deeply nested JSON objects in JWT claim sets. An attacker can craft a malicious JWT with excessively nested JSON structures, causing the parser to enter an infinite recursion loop, consuming excessive CPU and memory resources. This leads to application unresponsiveness or crashes. The vulnerability stems from the library’s failure to enforce depth limits on JSON nesting, independent of the underlying Gson parser’s limitations.
DailyCVE Form:
Platform: Nimbus JOSE + JWT
Version: < 10.0.2
Vulnerability: DoS (Uncontrolled Recursion)
Severity: Moderate
Date: Jul 11, 2025
Prediction: Patch expected by Jul 25, 2025
What Undercode Say:
Check JSON nesting depth in JWT claims jq 'def depth: if type == "object" or type == "array" then (map(depth) | max) + 1 else 0 end; depth' malicious_jwt.json Mitigation code snippet (Java) JsonParser.setMaxDepth(1000); // Enforce depth limit
How Exploit:
- Craft JWT with deeply nested JSON (> 1000 layers).
- Send to vulnerable endpoint.
- Trigger CPU/memory exhaustion.
Protection from this CVE:
- Upgrade to Nimbus JOSE + JWT 10.0.2+.
- Implement JSON depth validation.
- Use rate-limiting.
Impact:
- Service disruption.
- Resource exhaustion.
- No RCE/data breach.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
