Read the docs
TI-2017-09617 Aliases CVE-2017-12973GHSA-jfmq-4g4m-99rh

Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in…

Priority LOW 16CWE-354Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in authenticated AES-CBC decryption, which allows attackers to conduct a padding oracle attack.

Why it matters now

EPSS 0.00637 50th percentileScored 2026-11-07
Fix Fixed com.nimbusds:nimbus-jose-jwt (Maven): 4.39

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.nimbusds:nimbus-jose-jwt (Maven)before 4.394.39Patch availableGHSA-jfmq-4g4m-99rh
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.nimbusds:nimbus-jose-jwt (Maven) Vendor— Affected before 4.39 Fixed in 4.39 Patch available GHSA-jfmq-4g4m-99rh

CPE configurations NVD · 127

CPEVersionsRoleVendor
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.0:*:*:*:*:*:*:*1.0VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.1:*:*:*:*:*:*:*1.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.2:*:*:*:*:*:*:*1.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.3:*:*:*:*:*:*:*1.3VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.4:*:*:*:*:*:*:*1.4VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.5:*:*:*:*:*:*:*1.5VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.6:*:*:*:*:*:*:*1.6VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.7:*:*:*:*:*:*:*1.7VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.8:*:*:*:*:*:*:*1.8VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.9:*:*:*:*:*:*:*1.9VulnerableConnect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.4:*:*:*:*:*:*:* Versions 1.4 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.5:*:*:*:*:*:*:* Versions 1.5 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.6:*:*:*:*:*:*:* Versions 1.6 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.7:*:*:*:*:*:*:* Versions 1.7 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.8:*:*:*:*:*:*:* Versions 1.8 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.9:*:*:*:*:*:*:* Versions 1.9 Vulnerable ·Connect2id
Show 117 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.9.1:*:*:*:*:*:*:*1.9.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.10:*:*:*:*:*:*:*1.10VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.11:*:*:*:*:*:*:*1.11VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.12:*:*:*:*:*:*:*1.12VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.0:*:*:*:*:*:*:*2.0VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.1:*:*:*:*:*:*:*2.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.1.1:*:*:*:*:*:*:*2.1.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.2:*:*:*:*:*:*:*2.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.3:*:*:*:*:*:*:*2.3VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.4:*:*:*:*:*:*:*2.4VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.5:*:*:*:*:*:*:*2.5VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.6:*:*:*:*:*:*:*2.6VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.7:*:*:*:*:*:*:*2.7VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.8:*:*:*:*:*:*:*2.8VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.9:*:*:*:*:*:*:*2.9VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.10:*:*:*:*:*:*:*2.10VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.10.1:*:*:*:*:*:*:*2.10.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.11.0:*:*:*:*:*:*:*2.11.0VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.12.0:*:*:*:*:*:*:*2.12.0VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.13.0:*:*:*:*:*:*:*2.13.0VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.13.1:*:*:*:*:*:*:*2.13.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.14:*:*:*:*:*:*:*2.14VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.15:*:*:*:*:*:*:*2.15VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.15.1:*:*:*:*:*:*:*2.15.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.15.2:*:*:*:*:*:*:*2.15.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.16:*:*:*:*:*:*:*2.16VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.17:*:*:*:*:*:*:*2.17VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.17.1:*:*:*:*:*:*:*2.17.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.17.2:*:*:*:*:*:*:*2.17.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.18:*:*:*:*:*:*:*2.18VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.18.1:*:*:*:*:*:*:*2.18.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.18.2:*:*:*:*:*:*:*2.18.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.19:*:*:*:*:*:*:*2.19VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.19.1:*:*:*:*:*:*:*2.19.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.20:*:*:*:*:*:*:*2.20VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.21:*:*:*:*:*:*:*2.21VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.22:*:*:*:*:*:*:*2.22VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.22.1:*:*:*:*:*:*:*2.22.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.23:*:*:*:*:*:*:*2.23VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.24:*:*:*:*:*:*:*2.24VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.25:*:*:*:*:*:*:*2.25VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.26:*:*:*:*:*:*:*2.26VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.26.1:*:*:*:*:*:*:*2.26.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.0:*:*:*:*:*:*:*3.0VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.1:*:*:*:*:*:*:*3.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.1.1:*:*:*:*:*:*:*3.1.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.1.2:*:*:*:*:*:*:*3.1.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.2:*:*:*:*:*:*:*3.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.2.1:*:*:*:*:*:*:*3.2.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.2.2:*:*:*:*:*:*:*3.2.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.3:*:*:*:*:*:*:*3.3VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.4:*:*:*:*:*:*:*3.4VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.5:*:*:*:*:*:*:*3.5VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.6:*:*:*:*:*:*:*3.6VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.7:*:*:*:*:*:*:*3.7VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.8:*:*:*:*:*:*:*3.8VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.8.1:*:*:*:*:*:*:*3.8.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.8.2:*:*:*:*:*:*:*3.8.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.9:*:*:*:*:*:*:*3.9VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.9.1:*:*:*:*:*:*:*3.9.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.9.2:*:*:*:*:*:*:*3.9.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.10:*:*:*:*:*:*:*3.10VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.0:*:*:*:*:*:*:*4.0VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.0.1:*:*:*:*:*:*:*4.0.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.1:*:*:*:*:*:*:*4.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.1.1:*:*:*:*:*:*:*4.1.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.2:*:*:*:*:*:*:*4.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.3:*:*:*:*:*:*:*4.3VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.3.1:*:*:*:*:*:*:*4.3.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.4:*:*:*:*:*:*:*4.4VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.5:*:*:*:*:*:*:*4.5VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.6:*:*:*:*:*:*:*4.6VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.7:*:*:*:*:*:*:*4.7VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.8:*:*:*:*:*:*:*4.8VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.9:*:*:*:*:*:*:*4.9VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.10:*:*:*:*:*:*:*4.10VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.11:*:*:*:*:*:*:*4.11VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.11.1:*:*:*:*:*:*:*4.11.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.11.2:*:*:*:*:*:*:*4.11.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.12:*:*:*:*:*:*:*4.12VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.13:*:*:*:*:*:*:*4.13VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.13.1:*:*:*:*:*:*:*4.13.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.14:*:*:*:*:*:*:*4.14VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.15:*:*:*:*:*:*:*4.15VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.15.1:*:*:*:*:*:*:*4.15.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.16:*:*:*:*:*:*:*4.16VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.16.1:*:*:*:*:*:*:*4.16.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.16.2:*:*:*:*:*:*:*4.16.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.17:*:*:*:*:*:*:*4.17VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.18:*:*:*:*:*:*:*4.18VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.19:*:*:*:*:*:*:*4.19VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.20:*:*:*:*:*:*:*4.20VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.21:*:*:*:*:*:*:*4.21VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.22:*:*:*:*:*:*:*4.22VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.23:*:*:*:*:*:*:*4.23VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.24:*:*:*:*:*:*:*4.24VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.25:*:*:*:*:*:*:*4.25VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.26:*:*:*:*:*:*:*4.26VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.26.1:*:*:*:*:*:*:*4.26.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.27:*:*:*:*:*:*:*4.27VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.27.1:*:*:*:*:*:*:*4.27.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.28:*:*:*:*:*:*:*4.28VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.29:*:*:*:*:*:*:*4.29VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.30:*:*:*:*:*:*:*4.30VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.31:*:*:*:*:*:*:*4.31VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.31.1:*:*:*:*:*:*:*4.31.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.32:*:*:*:*:*:*:*4.32VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.33:*:*:*:*:*:*:*4.33VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.34:*:*:*:*:*:*:*4.34VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.34.1:*:*:*:*:*:*:*4.34.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.34.2:*:*:*:*:*:*:*4.34.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.35:*:*:*:*:*:*:*4.35VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.36.1:*:*:*:*:*:*:*4.36.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.37:*:*:*:*:*:*:*4.37VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.37.1:*:*:*:*:*:*:*4.37.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.38:*:*:*:*:*:*:*4.38VulnerableConnect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.9.1:*:*:*:*:*:*:* Versions 1.9.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.10:*:*:*:*:*:*:* Versions 1.10 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.11:*:*:*:*:*:*:* Versions 1.11 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.12:*:*:*:*:*:*:* Versions 1.12 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.3:*:*:*:*:*:*:* Versions 2.3 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.4:*:*:*:*:*:*:* Versions 2.4 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.5:*:*:*:*:*:*:* Versions 2.5 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.6:*:*:*:*:*:*:* Versions 2.6 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.7:*:*:*:*:*:*:* Versions 2.7 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.8:*:*:*:*:*:*:* Versions 2.8 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.9:*:*:*:*:*:*:* Versions 2.9 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.10:*:*:*:*:*:*:* Versions 2.10 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.10.1:*:*:*:*:*:*:* Versions 2.10.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.11.0:*:*:*:*:*:*:* Versions 2.11.0 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.12.0:*:*:*:*:*:*:* Versions 2.12.0 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.13.0:*:*:*:*:*:*:* Versions 2.13.0 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.13.1:*:*:*:*:*:*:* Versions 2.13.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.14:*:*:*:*:*:*:* Versions 2.14 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.15:*:*:*:*:*:*:* Versions 2.15 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.15.1:*:*:*:*:*:*:* Versions 2.15.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.15.2:*:*:*:*:*:*:* Versions 2.15.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.16:*:*:*:*:*:*:* Versions 2.16 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.17:*:*:*:*:*:*:* Versions 2.17 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.17.1:*:*:*:*:*:*:* Versions 2.17.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.17.2:*:*:*:*:*:*:* Versions 2.17.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.18:*:*:*:*:*:*:* Versions 2.18 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.18.1:*:*:*:*:*:*:* Versions 2.18.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.18.2:*:*:*:*:*:*:* Versions 2.18.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.19:*:*:*:*:*:*:* Versions 2.19 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.19.1:*:*:*:*:*:*:* Versions 2.19.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.20:*:*:*:*:*:*:* Versions 2.20 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.21:*:*:*:*:*:*:* Versions 2.21 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.22:*:*:*:*:*:*:* Versions 2.22 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.22.1:*:*:*:*:*:*:* Versions 2.22.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.23:*:*:*:*:*:*:* Versions 2.23 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.24:*:*:*:*:*:*:* Versions 2.24 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.25:*:*:*:*:*:*:* Versions 2.25 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.26:*:*:*:*:*:*:* Versions 2.26 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.26.1:*:*:*:*:*:*:* Versions 2.26.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.1.2:*:*:*:*:*:*:* Versions 3.1.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.3:*:*:*:*:*:*:* Versions 3.3 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.4:*:*:*:*:*:*:* Versions 3.4 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.5:*:*:*:*:*:*:* Versions 3.5 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.6:*:*:*:*:*:*:* Versions 3.6 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.7:*:*:*:*:*:*:* Versions 3.7 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.8:*:*:*:*:*:*:* Versions 3.8 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.8.1:*:*:*:*:*:*:* Versions 3.8.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.8.2:*:*:*:*:*:*:* Versions 3.8.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.9:*:*:*:*:*:*:* Versions 3.9 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.9.1:*:*:*:*:*:*:* Versions 3.9.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.9.2:*:*:*:*:*:*:* Versions 3.9.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.10:*:*:*:*:*:*:* Versions 3.10 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.1.1:*:*:*:*:*:*:* Versions 4.1.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.3.1:*:*:*:*:*:*:* Versions 4.3.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.4:*:*:*:*:*:*:* Versions 4.4 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.5:*:*:*:*:*:*:* Versions 4.5 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.6:*:*:*:*:*:*:* Versions 4.6 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.7:*:*:*:*:*:*:* Versions 4.7 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.8:*:*:*:*:*:*:* Versions 4.8 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.9:*:*:*:*:*:*:* Versions 4.9 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.11:*:*:*:*:*:*:* Versions 4.11 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.11.1:*:*:*:*:*:*:* Versions 4.11.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.11.2:*:*:*:*:*:*:* Versions 4.11.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.12:*:*:*:*:*:*:* Versions 4.12 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.13:*:*:*:*:*:*:* Versions 4.13 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.13.1:*:*:*:*:*:*:* Versions 4.13.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.14:*:*:*:*:*:*:* Versions 4.14 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.15:*:*:*:*:*:*:* Versions 4.15 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.15.1:*:*:*:*:*:*:* Versions 4.15.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.16:*:*:*:*:*:*:* Versions 4.16 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.16.1:*:*:*:*:*:*:* Versions 4.16.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.16.2:*:*:*:*:*:*:* Versions 4.16.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.17:*:*:*:*:*:*:* Versions 4.17 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.18:*:*:*:*:*:*:* Versions 4.18 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.19:*:*:*:*:*:*:* Versions 4.19 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.20:*:*:*:*:*:*:* Versions 4.20 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.21:*:*:*:*:*:*:* Versions 4.21 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.22:*:*:*:*:*:*:* Versions 4.22 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.23:*:*:*:*:*:*:* Versions 4.23 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.24:*:*:*:*:*:*:* Versions 4.24 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.25:*:*:*:*:*:*:* Versions 4.25 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.26:*:*:*:*:*:*:* Versions 4.26 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.26.1:*:*:*:*:*:*:* Versions 4.26.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.27:*:*:*:*:*:*:* Versions 4.27 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.27.1:*:*:*:*:*:*:* Versions 4.27.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.28:*:*:*:*:*:*:* Versions 4.28 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.29:*:*:*:*:*:*:* Versions 4.29 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.30:*:*:*:*:*:*:* Versions 4.30 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.31:*:*:*:*:*:*:* Versions 4.31 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.31.1:*:*:*:*:*:*:* Versions 4.31.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.32:*:*:*:*:*:*:* Versions 4.32 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.33:*:*:*:*:*:*:* Versions 4.33 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.34:*:*:*:*:*:*:* Versions 4.34 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.34.1:*:*:*:*:*:*:* Versions 4.34.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.34.2:*:*:*:*:*:*:* Versions 4.34.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.35:*:*:*:*:*:*:* Versions 4.35 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.36.1:*:*:*:*:*:*:* Versions 4.36.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.37:*:*:*:*:*:*:* Versions 4.37 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.37.1:*:*:*:*:*:*:* Versions 4.37.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.38:*:*:*:*:*:*:* Versions 4.38 Vulnerable ·Connect2id

Remediation

  • Fix · GHSA-jfmq-4g4m-99rh com.nimbusds:nimbus-jose-jwt (Maven) Fixed in 4.39 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-12973
  2. 2026-10-03 Alias added: GHSA-jfmq-4g4m-99rh
  3. 2026-10-25 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 3

  • TI-2019-12818 Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while… CVSS 3.1CRITICAL 9.8
  • TI-2023-28776 In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service… CVSS 3.1HIGH 7.5
  • TI-2017-09618 Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the… CVSS 3.0HIGH 7.5
  • TI-2017-09616 In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length… CVSS 3.0HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences