Read the docs
TI-2017-09618 Aliases CVE-2017-12974GHSA-pfv2-37f7-9m6w

Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the…

Priority LOW 35CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-347.

Summary

Nimbus JOSE+JWT before 4.36 proceeds with ECKey construction without ensuring that the public x and y coordinates are on the specified curve, which allows attackers to conduct an Invalid Curve Attack in environments where the JCE provider lacks the applicable curve validation.

Why it matters now

EPSS 0.01256 69th percentileScored 2026-11-07
Fix Fixed com.nimbusds:nimbus-jose-jwt (Maven): 4.36

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—com.nimbusds:nimbus-jose-jwt (Maven)before 4.364.36Patch availableGHSA-pfv2-37f7-9m6w
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • com.nimbusds:nimbus-jose-jwt (Maven) Vendor— Affected before 4.36 Fixed in 4.36 Patch available GHSA-pfv2-37f7-9m6w

CPE configurations NVD · 123

CPEVersionsRoleVendor
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.0:*:*:*:*:*:*:*1.0VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.1:*:*:*:*:*:*:*1.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.2:*:*:*:*:*:*:*1.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.3:*:*:*:*:*:*:*1.3VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.4:*:*:*:*:*:*:*1.4VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.5:*:*:*:*:*:*:*1.5VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.6:*:*:*:*:*:*:*1.6VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.7:*:*:*:*:*:*:*1.7VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.8:*:*:*:*:*:*:*1.8VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.9:*:*:*:*:*:*:*1.9VulnerableConnect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.3:*:*:*:*:*:*:* Versions 1.3 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.4:*:*:*:*:*:*:* Versions 1.4 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.5:*:*:*:*:*:*:* Versions 1.5 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.6:*:*:*:*:*:*:* Versions 1.6 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.7:*:*:*:*:*:*:* Versions 1.7 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.8:*:*:*:*:*:*:* Versions 1.8 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.9:*:*:*:*:*:*:* Versions 1.9 Vulnerable ·Connect2id
Show 113 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.9.1:*:*:*:*:*:*:*1.9.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.10:*:*:*:*:*:*:*1.10VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.11:*:*:*:*:*:*:*1.11VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.12:*:*:*:*:*:*:*1.12VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.0:*:*:*:*:*:*:*2.0VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.0.1:*:*:*:*:*:*:*2.0.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.1:*:*:*:*:*:*:*2.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.1.1:*:*:*:*:*:*:*2.1.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.2:*:*:*:*:*:*:*2.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.3:*:*:*:*:*:*:*2.3VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.4:*:*:*:*:*:*:*2.4VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.5:*:*:*:*:*:*:*2.5VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.6:*:*:*:*:*:*:*2.6VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.7:*:*:*:*:*:*:*2.7VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.8:*:*:*:*:*:*:*2.8VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.9:*:*:*:*:*:*:*2.9VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.10:*:*:*:*:*:*:*2.10VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.10.1:*:*:*:*:*:*:*2.10.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.11.0:*:*:*:*:*:*:*2.11.0VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.12.0:*:*:*:*:*:*:*2.12.0VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.13.0:*:*:*:*:*:*:*2.13.0VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.13.1:*:*:*:*:*:*:*2.13.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.14:*:*:*:*:*:*:*2.14VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.15:*:*:*:*:*:*:*2.15VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.15.1:*:*:*:*:*:*:*2.15.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.15.2:*:*:*:*:*:*:*2.15.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.16:*:*:*:*:*:*:*2.16VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.17:*:*:*:*:*:*:*2.17VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.17.1:*:*:*:*:*:*:*2.17.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.17.2:*:*:*:*:*:*:*2.17.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.18:*:*:*:*:*:*:*2.18VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.18.1:*:*:*:*:*:*:*2.18.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.18.2:*:*:*:*:*:*:*2.18.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.19:*:*:*:*:*:*:*2.19VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.19.1:*:*:*:*:*:*:*2.19.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.20:*:*:*:*:*:*:*2.20VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.21:*:*:*:*:*:*:*2.21VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.22:*:*:*:*:*:*:*2.22VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.22.1:*:*:*:*:*:*:*2.22.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.23:*:*:*:*:*:*:*2.23VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.24:*:*:*:*:*:*:*2.24VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.25:*:*:*:*:*:*:*2.25VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.26:*:*:*:*:*:*:*2.26VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.26.1:*:*:*:*:*:*:*2.26.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.0:*:*:*:*:*:*:*3.0VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.1:*:*:*:*:*:*:*3.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.1.1:*:*:*:*:*:*:*3.1.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.1.2:*:*:*:*:*:*:*3.1.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.2:*:*:*:*:*:*:*3.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.2.1:*:*:*:*:*:*:*3.2.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.2.2:*:*:*:*:*:*:*3.2.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.3:*:*:*:*:*:*:*3.3VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.4:*:*:*:*:*:*:*3.4VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.5:*:*:*:*:*:*:*3.5VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.6:*:*:*:*:*:*:*3.6VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.7:*:*:*:*:*:*:*3.7VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.8:*:*:*:*:*:*:*3.8VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.8.1:*:*:*:*:*:*:*3.8.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.8.2:*:*:*:*:*:*:*3.8.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.9:*:*:*:*:*:*:*3.9VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.9.1:*:*:*:*:*:*:*3.9.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.9.2:*:*:*:*:*:*:*3.9.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.10:*:*:*:*:*:*:*3.10VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.0:*:*:*:*:*:*:*4.0VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.0.1:*:*:*:*:*:*:*4.0.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.1:*:*:*:*:*:*:*4.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.1.1:*:*:*:*:*:*:*4.1.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.2:*:*:*:*:*:*:*4.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.3:*:*:*:*:*:*:*4.3VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.3.1:*:*:*:*:*:*:*4.3.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.4:*:*:*:*:*:*:*4.4VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.5:*:*:*:*:*:*:*4.5VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.6:*:*:*:*:*:*:*4.6VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.7:*:*:*:*:*:*:*4.7VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.8:*:*:*:*:*:*:*4.8VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.9:*:*:*:*:*:*:*4.9VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.10:*:*:*:*:*:*:*4.10VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.11:*:*:*:*:*:*:*4.11VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.11.1:*:*:*:*:*:*:*4.11.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.11.2:*:*:*:*:*:*:*4.11.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.12:*:*:*:*:*:*:*4.12VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.13:*:*:*:*:*:*:*4.13VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.13.1:*:*:*:*:*:*:*4.13.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.14:*:*:*:*:*:*:*4.14VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.15:*:*:*:*:*:*:*4.15VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.15.1:*:*:*:*:*:*:*4.15.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.16:*:*:*:*:*:*:*4.16VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.16.1:*:*:*:*:*:*:*4.16.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.16.2:*:*:*:*:*:*:*4.16.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.17:*:*:*:*:*:*:*4.17VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.18:*:*:*:*:*:*:*4.18VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.19:*:*:*:*:*:*:*4.19VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.20:*:*:*:*:*:*:*4.20VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.21:*:*:*:*:*:*:*4.21VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.22:*:*:*:*:*:*:*4.22VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.23:*:*:*:*:*:*:*4.23VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.24:*:*:*:*:*:*:*4.24VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.25:*:*:*:*:*:*:*4.25VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.26:*:*:*:*:*:*:*4.26VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.26.1:*:*:*:*:*:*:*4.26.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.27:*:*:*:*:*:*:*4.27VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.27.1:*:*:*:*:*:*:*4.27.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.28:*:*:*:*:*:*:*4.28VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.29:*:*:*:*:*:*:*4.29VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.30:*:*:*:*:*:*:*4.30VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.31:*:*:*:*:*:*:*4.31VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.31.1:*:*:*:*:*:*:*4.31.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.32:*:*:*:*:*:*:*4.32VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.33:*:*:*:*:*:*:*4.33VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.34:*:*:*:*:*:*:*4.34VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.34.1:*:*:*:*:*:*:*4.34.1VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.34.2:*:*:*:*:*:*:*4.34.2VulnerableConnect2id
cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.35:*:*:*:*:*:*:*4.35VulnerableConnect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.9.1:*:*:*:*:*:*:* Versions 1.9.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.10:*:*:*:*:*:*:* Versions 1.10 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.11:*:*:*:*:*:*:* Versions 1.11 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:1.12:*:*:*:*:*:*:* Versions 1.12 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.3:*:*:*:*:*:*:* Versions 2.3 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.4:*:*:*:*:*:*:* Versions 2.4 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.5:*:*:*:*:*:*:* Versions 2.5 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.6:*:*:*:*:*:*:* Versions 2.6 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.7:*:*:*:*:*:*:* Versions 2.7 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.8:*:*:*:*:*:*:* Versions 2.8 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.9:*:*:*:*:*:*:* Versions 2.9 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.10:*:*:*:*:*:*:* Versions 2.10 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.10.1:*:*:*:*:*:*:* Versions 2.10.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.11.0:*:*:*:*:*:*:* Versions 2.11.0 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.12.0:*:*:*:*:*:*:* Versions 2.12.0 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.13.0:*:*:*:*:*:*:* Versions 2.13.0 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.13.1:*:*:*:*:*:*:* Versions 2.13.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.14:*:*:*:*:*:*:* Versions 2.14 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.15:*:*:*:*:*:*:* Versions 2.15 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.15.1:*:*:*:*:*:*:* Versions 2.15.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.15.2:*:*:*:*:*:*:* Versions 2.15.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.16:*:*:*:*:*:*:* Versions 2.16 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.17:*:*:*:*:*:*:* Versions 2.17 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.17.1:*:*:*:*:*:*:* Versions 2.17.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.17.2:*:*:*:*:*:*:* Versions 2.17.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.18:*:*:*:*:*:*:* Versions 2.18 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.18.1:*:*:*:*:*:*:* Versions 2.18.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.18.2:*:*:*:*:*:*:* Versions 2.18.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.19:*:*:*:*:*:*:* Versions 2.19 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.19.1:*:*:*:*:*:*:* Versions 2.19.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.20:*:*:*:*:*:*:* Versions 2.20 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.21:*:*:*:*:*:*:* Versions 2.21 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.22:*:*:*:*:*:*:* Versions 2.22 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.22.1:*:*:*:*:*:*:* Versions 2.22.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.23:*:*:*:*:*:*:* Versions 2.23 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.24:*:*:*:*:*:*:* Versions 2.24 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.25:*:*:*:*:*:*:* Versions 2.25 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.26:*:*:*:*:*:*:* Versions 2.26 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:2.26.1:*:*:*:*:*:*:* Versions 2.26.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.1:*:*:*:*:*:*:* Versions 3.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.1.2:*:*:*:*:*:*:* Versions 3.1.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.2:*:*:*:*:*:*:* Versions 3.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.3:*:*:*:*:*:*:* Versions 3.3 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.4:*:*:*:*:*:*:* Versions 3.4 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.5:*:*:*:*:*:*:* Versions 3.5 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.6:*:*:*:*:*:*:* Versions 3.6 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.7:*:*:*:*:*:*:* Versions 3.7 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.8:*:*:*:*:*:*:* Versions 3.8 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.8.1:*:*:*:*:*:*:* Versions 3.8.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.8.2:*:*:*:*:*:*:* Versions 3.8.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.9:*:*:*:*:*:*:* Versions 3.9 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.9.1:*:*:*:*:*:*:* Versions 3.9.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.9.2:*:*:*:*:*:*:* Versions 3.9.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:3.10:*:*:*:*:*:*:* Versions 3.10 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.1.1:*:*:*:*:*:*:* Versions 4.1.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.3.1:*:*:*:*:*:*:* Versions 4.3.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.4:*:*:*:*:*:*:* Versions 4.4 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.5:*:*:*:*:*:*:* Versions 4.5 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.6:*:*:*:*:*:*:* Versions 4.6 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.7:*:*:*:*:*:*:* Versions 4.7 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.8:*:*:*:*:*:*:* Versions 4.8 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.9:*:*:*:*:*:*:* Versions 4.9 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.10:*:*:*:*:*:*:* Versions 4.10 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.11:*:*:*:*:*:*:* Versions 4.11 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.11.1:*:*:*:*:*:*:* Versions 4.11.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.11.2:*:*:*:*:*:*:* Versions 4.11.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.12:*:*:*:*:*:*:* Versions 4.12 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.13:*:*:*:*:*:*:* Versions 4.13 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.13.1:*:*:*:*:*:*:* Versions 4.13.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.14:*:*:*:*:*:*:* Versions 4.14 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.15:*:*:*:*:*:*:* Versions 4.15 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.15.1:*:*:*:*:*:*:* Versions 4.15.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.16:*:*:*:*:*:*:* Versions 4.16 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.16.1:*:*:*:*:*:*:* Versions 4.16.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.16.2:*:*:*:*:*:*:* Versions 4.16.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.17:*:*:*:*:*:*:* Versions 4.17 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.18:*:*:*:*:*:*:* Versions 4.18 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.19:*:*:*:*:*:*:* Versions 4.19 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.20:*:*:*:*:*:*:* Versions 4.20 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.21:*:*:*:*:*:*:* Versions 4.21 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.22:*:*:*:*:*:*:* Versions 4.22 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.23:*:*:*:*:*:*:* Versions 4.23 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.24:*:*:*:*:*:*:* Versions 4.24 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.25:*:*:*:*:*:*:* Versions 4.25 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.26:*:*:*:*:*:*:* Versions 4.26 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.26.1:*:*:*:*:*:*:* Versions 4.26.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.27:*:*:*:*:*:*:* Versions 4.27 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.27.1:*:*:*:*:*:*:* Versions 4.27.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.28:*:*:*:*:*:*:* Versions 4.28 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.29:*:*:*:*:*:*:* Versions 4.29 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.30:*:*:*:*:*:*:* Versions 4.30 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.31:*:*:*:*:*:*:* Versions 4.31 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.31.1:*:*:*:*:*:*:* Versions 4.31.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.32:*:*:*:*:*:*:* Versions 4.32 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.33:*:*:*:*:*:*:* Versions 4.33 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.34:*:*:*:*:*:*:* Versions 4.34 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.34.1:*:*:*:*:*:*:* Versions 4.34.1 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.34.2:*:*:*:*:*:*:* Versions 4.34.2 Vulnerable ·Connect2id
  • cpe:2.3:a:connect2id:nimbus_jose\+jwt:4.35:*:*:*:*:*:*:* Versions 4.35 Vulnerable ·Connect2id

Remediation

  • Fix · GHSA-pfv2-37f7-9m6w com.nimbusds:nimbus-jose-jwt (Maven) Fixed in 4.36 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-12974
  2. 2026-10-03 Alias added: GHSA-pfv2-37f7-9m6w

References

Patch 1

Advisory 3

Other 3

  • TI-2019-12818 Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while… CVSS 3.1CRITICAL 9.8
  • TI-2023-28776 In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service… CVSS 3.1HIGH 7.5
  • TI-2017-09616 In Nimbus JOSE+JWT before 4.39, there is no integer-overflow check when converting length… CVSS 3.0HIGH 7.5
  • TI-2017-09617 Nimbus JOSE+JWT before 4.39 proceeds improperly after detection of an invalid HMAC in… CVSS 3.0LOW 3.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences