firmware-hub/edge-service
2
0
Fork 0
Code Issues 1 Pull Requests 11 Actions Packages Projects Releases Wiki Activity

Update dependency com.nimbusds:nimbus-jose-jwt to v10 [SECURITY] #12

Open
renovate wants to merge 1 commits from renovate/maven-com.nimbusds-nimbus-jose-jwt-vulnerability into main
pull from: renovate/maven-com.nimbusds-nimbus-jose-jwt-vulnerability
merge into: :main
Conversation 1 Commits 1 Files Changed 1
+1 -1
renovate commented 2026-08-12 01:47:55 +00:00
Member
Copy Link
Copy Source

This PR contains the following updates:

Package Change Age Confidence
com.nimbusds:nimbus-jose-jwt 9.47 → 10.0.2 age confidence

Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON

CVE-2025-53864 / GHSA-xwmg-2g98-w7v9

More information

Details

Connect2id Nimbus JOSE + JWT before 10.0.2 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.

Severity

  • CVSS Score: 5.8 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

connect2id/nimbus-jose-jwt (com.nimbusds:nimbus-jose-jwt)

v10.0.2

Compare Source

v10.0.1

Compare Source

v10.0

Compare Source

v9.48

Compare Source

Configuration

📅 Schedule: (in timezone Europe/Berlin)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [com.nimbusds:nimbus-jose-jwt](https://bitbucket.org/connect2id/nimbus-jose-jwt) | `9.47` → `10.0.2` | ![age](https://developer.mend.io/api/mc/badges/age/maven/com.nimbusds:nimbus-jose-jwt/10.0.2?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/maven/com.nimbusds:nimbus-jose-jwt/9.47/10.0.2?slim=true) | --- ### Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON [CVE-2025-53864](https://nvd.nist.gov/vuln/detail/CVE-2025-53864) / [GHSA-xwmg-2g98-w7v9](https://github.com/advisories/GHSA-xwmg-2g98-w7v9) <details> <summary>More information</summary> #### Details Connect2id Nimbus JOSE + JWT before 10.0.2 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson. #### Severity - CVSS Score: 5.8 / 10 (Medium) - Vector String: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L` #### References - [https://nvd.nist.gov/vuln/detail/CVE-2025-53864](https://nvd.nist.gov/vuln/detail/CVE-2025-53864) - [https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b](https://github.com/google/gson/commit/1039427ff0100293dd3cf967a53a55282c0fef6b) - [https://bitbucket.org/connect2id/nimbus-jose-jwt](https://bitbucket.org/connect2id/nimbus-jose-jwt) - [https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c](https://bitbucket.org/connect2id/nimbus-jose-jwt/commits/f7fb882cc08f027c9ceb874acec3b51c6222861c) - [https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested](https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/583/stackoverflowerror-due-to-deeply-nested) - [https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch](https://bitbucket.org/connect2id/nimbus-jose-jwt/issues/593/back-port-cve-2025-53864-fix-to-9x-branch) - [https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0](https://github.com/google/gson/compare/gson-parent-2.11.0...gson-parent-2.12.0) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-xwmg-2g98-w7v9) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>connect2id/nimbus-jose-jwt (com.nimbusds:nimbus-jose-jwt)</summary> ### [`v10.0.2`](https://bitbucket.org/connect2id/nimbus-jose-jwt/branches/compare/10.0.2%0D10.0.1) [Compare Source](https://bitbucket.org/connect2id/nimbus-jose-jwt/branches/compare/10.0.2%0D10.0.1) ### [`v10.0.1`](https://bitbucket.org/connect2id/nimbus-jose-jwt/branches/compare/10.0.1%0D10.0) [Compare Source](https://bitbucket.org/connect2id/nimbus-jose-jwt/branches/compare/10.0.1%0D10.0) ### [`v10.0`](https://bitbucket.org/connect2id/nimbus-jose-jwt/branches/compare/10.0%0D9.48) [Compare Source](https://bitbucket.org/connect2id/nimbus-jose-jwt/branches/compare/10.0%0D9.48) ### [`v9.48`](https://bitbucket.org/connect2id/nimbus-jose-jwt/branches/compare/9.48%0D9.47) [Compare Source](https://bitbucket.org/connect2id/nimbus-jose-jwt/branches/compare/9.48%0D9.47) </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Berlin) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yNC4zIiwidXBkYXRlZEluVmVyIjoiNDQuNjUuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->
renovate added 1 commit 2026-08-12 01:47:56 +00:00
Update dependency com.nimbusds:nimbus-jose-jwt to v10 [SECURITY] 4fd68f169f
renovate scheduled this pull request to auto merge when all checks succeed 2026-08-12 01:47:57 +00:00
mars3142 commented 2026-08-12 01:48:13 +00:00
Owner
Copy Link
Copy Source

PR Code Suggestions ✨

No code suggestions found for the PR.

## PR Code Suggestions ✨ No code suggestions found for the PR.
You are not authorized to merge this pull request.
This pull request can be merged automatically.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/maven-com.nimbusds-nimbus-jose-jwt-vulnerability:renovate/maven-com.nimbusds-nimbus-jose-jwt-vulnerability
git checkout renovate/maven-com.nimbusds-nimbus-jose-jwt-vulnerability
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
mars3142 (Peter Siegmund) renovate (Renovate Agent)
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: firmware-hub/edge-service#12