CVE-2019-17195: Improper Check for Unusual or Exceptional Conditions in Connect2id Nimbus JOSE+JWT
Summary
CVE-2019-17195: Improper Check for Unusual or Exceptional Conditions in Connect2id Nimbus JOSE+JWT. Affects com.nimbusds:nimbus-jose-jwt versions < 7.9. Fixed in 7.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Connect2id Nimbus JOSE+JWT is a Java library for JSON Object Signing and Encryption (JOSE) and JSON Web Tokens (JWT). It provides functionality for parsing, creating, and validating JWTs. This vulnerability affects versions before v7.9 of the library. Connect2id Nimbus JOSE+JWT can throw various uncaught exceptions while parsing a JWT, which could result in an application crash or a potential authentication bypass. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
Vulnerability Detail
The vulnerability arises from an improper check for unusual or exceptional conditions in the parsing process of a JWT. This can lead to uncaught exceptions being thrown, potentially causing an application crash or allowing an attacker to bypass authentication. The lack of proper exception handling can result in information disclosure and compromise the security of the application.
How To Fix
Latest published version: 10.10 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.9
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is essential to update the library to the fixed version to mitigate the risk effectively.
Conclusion
The vulnerability in Connect2id Nimbus JOSE+JWT before v7.9 can lead to application crashes and potential authentication bypasses. It is recommended to update the library to version 7.9 or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.nimbusds:nimbus-jose-jwt →
FAQ
Connect2id Nimbus JOSE+JWT is a Java library for JSON Object Signing and Encryption (JOSE) and JSON Web Tokens (JWT). It provides functionality for parsing, creating, and validating JWTs.
The vulnerability can result in an application crash or potential authentication bypass. This could lead to information disclosure and compromise the security of the application.
The CVSS score of this vulnerability is 9.8, indicating its critical severity.
To fix this vulnerability, update the Connect2id Nimbus JOSE+JWT library to version 7.9 or later.
No specific workaround is provided for this vulnerability. It is crucial to update the library to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for com.nimbusds:nimbus-jose-jwt.
