Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2023-52428

22
FAUCET Score

CVE-2023-52428 is a denial-of-service vulnerability affecting Connect2id Nimbus JOSE+JWT versions prior to 9.37.2. An unauthenticated attacker can exploit this by providing a large iteration count in the JWE p2c header, leading to excessive resource consumption during PBKDF2 decryption. Rated 7.5 HIGH, this vulnerability requires no user interaction and has a high impact on availability, but no impact on confidentiality or integrity. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
< 9.37.2CPE matchmatch criteria
cpe:2.3:a:connect2id:nimbus_jose\+jwt:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.81%
Probability of exploitation in next 30 days
EPSS Percentile
53.3%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0081 is in the 28th percentile among its peer group of 51,551 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (89)

mavenpatch availablevia ghsa
Product: com.nimbusds:nimbus-jose-jwtFixed in: 9.37.2
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-insights-java-client-0:1.1.3-1.redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-objectweb-asm-0:9.6.0-1.redhat_00002.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-pem-keystore-0:2.3.0-1.redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-resteasy-extensions-0:2.0.1-3.Final_redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-resteasy-spring-0:3.0.1-2.Final_redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-saaj-impl-0:3.0.4-1.redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-shibboleth-java-support-0:8.0.0-6.redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-slf4j-0:2.0.16-1.redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-snakeyaml-0:2.2.0-1.redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-wildfly-0:8.0.4-2.GA_redhat_00005.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Streams for Apache Kafka 2.9.0
View patch
redhatpatch availablevia redhat_api
Product: Red Hat build of Apache Camel 3.20.7 for Spring BootFixed in: com.nimbusds/nimbus-jose-jwt
View patch
redhatpatch availablevia redhat_api
Product: Red Hat build of Apache Camel 4.4.3 for Spring BootFixed in: com.nimbusds/nimbus-jose-jwt
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8Fixed in: nimbus-jose-jwt
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-activemq-artemis-0:2.33.0-1.redhat_00015.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-activemq-artemis-native-1:2.0.0-2.redhat_00005.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-aesh-extensions-0:1.8.0-2.redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-aesh-readline-0:2.2.0-2.redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-apache-commons-codec-0:1.16.1-2.redhat_00007.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-apache-commons-collections-0:3.2.2-28.redhat_2.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-apache-commons-io-0:2.15.1-1.redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-apache-commons-lang-0:3.14.0-2.redhat_00006.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-apache-cxf-0:4.0.5-1.redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-artemis-native-1:2.0.0-2.redhat_00005.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-artemis-wildfly-integration-0:2.0.1-1.redhat_00002.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-asyncutil-0:0.1.0-2.redhat_00010.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-aws-java-sdk-0:1.12.284-2.redhat_00002.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-cryptacular-0:1.2.5-2.redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-eap-product-conf-parent-0:800.4.0-1.GA_redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-fastinfoset-0:2.1.0-4.redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-hibernate-0:6.2.31-1.Final_redhat_00002.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-hibernate-validator-0:8.0.1-3.Final_redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-hppc-0:0.8.1-2.redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-insights-java-client-0:1.1.3-1.redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-jakarta-servlet-jsp-jstl-api-0:3.0.1-1.redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-jboss-cert-helper-0:1.1.3-1.redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-jboss-logging-0:3.5.3-1.Final_redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-jctools-0:4.0.2-1.redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-jgroups-0:5.3.10-1.Final_redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-log4j-0:2.22.1-1.redhat_00002.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-narayana-0:6.0.3-1.Final_redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-nimbus-jose-jwt-0:9.37.3-1.redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-objectweb-asm-0:9.6.0-1.redhat_00002.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-pem-keystore-0:2.3.0-1.redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-resteasy-extensions-0:2.0.1-3.Final_redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-resteasy-spring-0:3.0.1-2.Final_redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-saaj-impl-0:3.0.4-1.redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-shibboleth-java-support-0:8.0.0-6.redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-slf4j-0:2.0.16-1.redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-snakeyaml-0:2.2.0-1.redhat_00001.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8Fixed in: eap8-wildfly-0:8.0.4-2.GA_redhat_00005.1.el8eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-activemq-artemis-0:2.33.0-1.redhat_00015.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-activemq-artemis-native-1:2.0.0-2.redhat_00005.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-aesh-extensions-0:1.8.0-2.redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-aesh-readline-0:2.2.0-2.redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-apache-commons-codec-0:1.16.1-2.redhat_00007.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-apache-commons-collections-0:3.2.2-28.redhat_2.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-apache-commons-io-0:2.15.1-1.redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-apache-commons-lang-0:3.14.0-2.redhat_00006.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-apache-cxf-0:4.0.5-1.redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-artemis-native-1:2.0.0-2.redhat_00005.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-artemis-wildfly-integration-0:2.0.1-1.redhat_00002.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-asyncutil-0:0.1.0-2.redhat_00010.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-aws-java-sdk-0:1.12.284-2.redhat_00002.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-cryptacular-0:1.2.5-2.redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-eap-product-conf-parent-0:800.4.0-1.GA_redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-fastinfoset-0:2.1.0-4.redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-hibernate-0:6.2.31-1.Final_redhat_00002.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-hibernate-validator-0:8.0.1-3.Final_redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-hppc-0:0.8.1-2.redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-jakarta-servlet-jsp-jstl-api-0:3.0.1-1.redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-jboss-cert-helper-0:1.1.3-1.redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-jboss-logging-0:3.5.3-1.Final_redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-jctools-0:4.0.2-1.redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-jgroups-0:5.3.10-1.Final_redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-log4j-0:2.22.1-1.redhat_00002.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-narayana-0:6.0.3-1.Final_redhat_00001.1.el9eap
View patch
redhatpatch availablevia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9Fixed in: eap8-nimbus-jose-jwt-0:9.37.3-1.redhat_00001.1.el9eap
View patch
redhatno patchvia redhat_api
Product: Logging Subsystem for Red Hat OpenShiftFixed in: com.nimbusds/nimbus-jose-jwt
redhatno patchvia redhat_api
Product: Red Hat build of Apache Camel for Spring Boot 3Fixed in: com.nimbusds/nimbus-jose-jwt
redhatno patchvia redhat_api
Product: Red Hat build of Apache Camel - HawtIO 4Fixed in: com.nimbusds/nimbus-jose-jwt
redhatno patchvia redhat_api
Product: Red Hat build of Apicurio Registry 2Fixed in: com.nimbusds/nimbus-jose-jwt
redhatno patchvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform Expansion PackFixed in: nimbus-jose-jwt
redhatno patchvia redhat_api
Product: Red Hat JBoss Enterprise Application Platform 7Fixed in: nimbus-jose-jwt
redhatend of lifevia redhat_api
Product: streams for Apache KafkaFixed in: com.nimbusds/nimbus-jose-jwt
redhatend of lifevia redhat_api
Product: Red Hat JBoss Data Grid 7Fixed in: com.nimbusds/nimbus-jose-jwt
redhatend of lifevia redhat_api
Product: Red Hat Fuse 7Fixed in: com.nimbusds/nimbus-jose-jwt
redhatend of lifevia redhat_api
Product: Red Hat AMQ Broker 7Fixed in: com.nimbusds/nimbus-jose-jwt

Vendor Advisories (2)

mavenGHSA-gvpg-vgmx-xg6whigh

Denial of Service in Connect2id Nimbus JOSE+JWT

Feb 11, 2024
redhatCVE-2023-52428Important

nimbus-jose-jwt: large JWE p2c header value causes Denial of Service

Feb 11, 2024

References

bitbucket.org / connect2id/nimbus-jose-jwt/commits/3b3b77e
Patch
bitbucket.org / connect2id/nimbus-jose-jwt/issues/526
Issue Tracking
connect2id.com / products/nimbus-jose-jwt
Product