StackRadar

CVE-2025-53864

Medium

Advisory

Published 11 Jul 2025In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
5.8
base score, highest
EPSS
0.008
56th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
169
of 17,781 indexed, latest versions
Container images
177
deployed by those charts
Fix available
1 of 1
affected package

Nimbus JOSE + JWT is vulnerable to DoS attacks when processing deeply nested JSON

Carried by container images the latest versions of 169 of 17,781 indexed charts deploy, on 177 images.

Affected packageAffected versionsFixed inImages
nimbus-jose-jwtmaven3.1.2, 3.9, 4.41.1, 4.41.2+35 more9.37.4, 10.0.2177
OSV records
GHSA-xwmg-2g98-w7v9

Charts affected

169 by stars
ChartLatestAffected imagesRadar Score
ibm-app-navigatoribm-charts1.0.11 of 5See more

ibm-app-navigator ibm-charts 1.0.1

1 of the 5 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
ibmcom/app-nav-api:1.0.1ce9d2a564273
nimbus-jose-jwt@7.6
9.37.4

Open the chart page →

32,915
ibm-business-automation-insights-devibm-charts3.2.01 of 6See more

ibm-business-automation-insights-dev ibm-charts 3.2.0

1 of the 6 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
ibmcom/bai-flink-dev:19.0.2e31ff09e8aad
nimbus-jose-jwt@3.9
9.37.4

Open the chart page →

39,349
ibm-ws-dyn-agent-devibm-charts1.0.01 of 1See more

ibm-ws-dyn-agent-dev ibm-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
ibmcom/ibm-workload-scheduler-agent-dynamic-dev:9.4.0.047e4dc1e27cdf
nimbus-jose-jwt@3.1.2
9.37.4

Open the chart page →

19,295
ikigaiikigai-chartVerified publisher0.0.91 of 58See more

ikigai ikigai-chart 0.0.9

1 of the 58 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
dremio/dremio-oss:24.1.080ed2e3b7c43
nimbus-jose-jwt@8.8
9.37.4

Open the chart page →

37,671
nifi-registryimprowisedVerified publisher1.0.01 of 2See more

nifi-registry improwised 1.0.0

1 of the 2 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
apache/nifi-registry:1.27.063b8e3e40742
nimbus-jose-jwt@9.37.3
9.37.4

Open the chart page →

5,320
fpga-operatorinaccelVerified publisher2.8.21 of 7See more

fpga-operator inaccel 2.8.2

1 of the 7 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
inaccel/coral:2.18c53744ed70b
nimbus-jose-jwt@9.8.1
9.37.4

Open the chart page →

5,759
delta-sharing-serverinseefrlab1.2.11 of 1See more

delta-sharing-server inseefrlab 1.2.1

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
deltaio/delta-sharing-server:0.2.08b75118187c5
nimbus-jose-jwt@7.9
9.37.4

Open the chart page →

6,174
appswitcher-serverit-at-mOfficialVerified publisher2.0.21 of 1See more

appswitcher-server it-at-m 2.0.2

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/appswitcher-server:1.3.010006bc0f309
nimbus-jose-jwt@9.37.3
9.37.4

Open the chart page →

3,774
kf-app-eaiit-at-mOfficialVerified publisher0.1.71 of 1See more

kf-app-eai it-at-m 0.1.7

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
ghcr.io/it-at-m/kf-app-eai:1.0.65de339b3d537
nimbus-jose-jwt@9.37.3
9.37.4

Open the chart page →

1,947
fpga-operatorkubesphere-stable2.7.41 of 7See more

fpga-operator kubesphere-stable 2.7.4

1 of the 7 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
inaccel/coral:2.18c53744ed70b
nimbus-jose-jwt@9.8.1
9.37.4

Open the chart page →

5,759
strimzi-kafka-operatorkvalitetsitVerified publisher0.36.11 of 1See more

strimzi-kafka-operator kvalitetsit 0.36.1

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.36.1e9e03b31007c
nimbus-jose-jwt@9.31
9.37.4

Open the chart page →

4,098
mock-oidclabs64io-helm-chartsVerified publisher0.1.01 of 1See more

mock-oidc labs64io-helm-charts 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
ghcr.io/navikt/mock-oauth2-server:2.1.1065d4ed47ce09
nimbus-jose-jwt@9.40
10.0.2

Open the chart page →

703
komgalinkding0.2.31 of 1See more

komga linkding 0.2.3

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
gotson/komga:1.22.0ba892ab3e082
nimbus-jose-jwt@9.37.3
9.37.4

Open the chart page →

3,131
elastictranscoderluiscajl0.46.03 of 4See more

elastictranscoder luiscajl 0.46.0

3 of the 4 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
elastictranscoder/media:627e21dc963ab3858c6b
nimbus-jose-jwt@9.8.1
9.37.4
elastictranscoder/media-storage:f6d861a026208b8c2359
nimbus-jose-jwt@9.8.1
9.37.4
elastictranscoder/transcoder-handler:627e21dc5b75d19e2733
nimbus-jose-jwt@9.8.1
9.37.4

Open the chart page →

58,160
lavandaluiscajl0.0.1343 of 5See more

lavanda luiscajl 0.0.134

3 of the 5 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
lavandadelpatio/automated-download-films:0.0.2094e225a5a6f8
nimbus-jose-jwt@8.19
9.37.4
lavandadelpatio/automated-download-shows:0.0.492de3c3426d2
nimbus-jose-jwt@8.19
9.37.4
lavandadelpatio/filebot:0.0.671f2ccec8c0d
nimbus-jose-jwt@8.20.2
9.37.4

Open the chart page →

18,248
metabase-k8smetabase-k8s1.0.01 of 1See more

metabase-k8s metabase-k8s 1.0.0

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
metabase/metabase:v0.53.4.17807bc5cad17
nimbus-jose-jwt@9.37.2
9.37.4

Open the chart page →

2,589
elasticmicroboxlabs0.3.01 of 1See more

elastic microboxlabs 0.3.0

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
library/elasticsearch:8.17.32cc40b15dff8
nimbus-jose-jwt@10.0.1
10.0.2

Open the chart page →

4,257
resource-processormicroservices-learningVerified publisher1.2.01 of 1See more

resource-processor microservices-learning 1.2.0

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
maksimkavalenka/microservices-learning.resource-processor:latest64a25afb8748
nimbus-jose-jwt@9.31
9.37.4

Open the chart page →

3,683
resource-servicemicroservices-learningVerified publisher1.5.01 of 2See more

resource-service microservices-learning 1.5.0

1 of the 2 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
maksimkavalenka/microservices-learning.resource-service:latest13ad9bb170a0
nimbus-jose-jwt@9.31
9.37.4

Open the chart page →

5,129
crowdmoxVerified publisher2.4.31 of 3See more

crowd mox 2.4.3

1 of the 3 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
atlassian/crowd:5.2.2ebf761c7d437
nimbus-jose-jwt@9.31
9.37.4

Open the chart page →

5,663
myappmyapp-helm-charts0.4.01 of 1See more

myapp myapp-helm-charts 0.4.0

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
adityaprasadpathak/myapp:3.07e3b9777362c
nimbus-jose-jwt@9.8.1
9.37.4

Open the chart page →

2,141
elasticsearch-chartmy-elasticsearch0.1.01 of 2See more

elasticsearch-chart my-elasticsearch 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
library/elasticsearch:7.17.35e6ac15bf6a5
nimbus-jose-jwt@9.8.1
9.37.4

Open the chart page →

9,300
logic-ms-helm-chartnotesprojectchart0.1.01 of 2See more

logic-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
vlebediantsev/logic-ms:latestdf8bf38c535b
nimbus-jose-jwt@9.22
9.37.4

Open the chart page →

6,852
registration-ms-helm-chartnotesprojectchart0.1.01 of 2See more

registration-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
vlebediantsev/registration-ms-final:latest427af418b75e
nimbus-jose-jwt@9.22
9.37.4

Open the chart page →

5,916
user-data-ms-helm-chartnotesprojectchart0.1.01 of 2See more

user-data-ms-helm-chart notesprojectchart 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
vlebediantsev/user-data-ms-final-final:latest9319437f3c8f
nimbus-jose-jwt@9.22
9.37.4

Open the chart page →

5,873
my-bloody-jenkinsodavid0.1.2181 of 1See more

my-bloody-jenkins odavid 0.1.218

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
odavid/my-bloody-jenkins:2.462.3-306e7ab3bbc948e
nimbus-jose-jwt@9.37.2
9.37.4

Open the chart page →

5,826
hive-metastoreolehrgfVerified publisher0.1.01 of 1See more

hive-metastore olehrgf 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
ghcr.io/melodyyangaws/hive-metastore:3.0.0e949b0f733f0
nimbus-jose-jwt@9.8.1
9.37.4

Open the chart page →

8,540
onedevonedev11.9.01 of 1See more

onedev onedev 11.9.0

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
1dev/server:11.9.0cd5b12fe5471
nimbus-jose-jwt@9.37.3
9.37.4

Open the chart page →

6,037
mockserveropen-charts1.1.01 of 1See more

mockserver open-charts 1.1.0

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
mockserver/mockserver:5.15.00f9ef78c9489
nimbus-jose-jwt@9.28
9.37.4

Open the chart page →

1,257
fineractopenshift0.1.11 of 4See more

fineract openshift 0.1.1

1 of the 4 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
apache/fineract:1.12.1a83cf1980609
nimbus-jose-jwt@9.37.3
9.37.4

Open the chart page →

7,792
smsf-momtopenshift1.0.41 of 1See more

smsf-momt openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
gurolakman/smsf-momt:1.0.4ce23b20a8a17
nimbus-jose-jwt@9.14
9.37.4

Open the chart page →

13,568
smsf-registrationopenshift1.0.41 of 1See more

smsf-registration openshift 1.0.4

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
gurolakman/smsf-registration:1.0.4b22e746edd5d
nimbus-jose-jwt@9.14
9.37.4

Open the chart page →

13,551
openwhiskopenwhisk1.0.01 of 10See more

openwhisk openwhisk 1.0.0

1 of the 10 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
library/zookeeper:3.43882d9493d38
nimbus-jose-jwt@4.41.2
9.37.4

Open the chart page →

36,215
operatonoperatonVerified publisher1.0.51 of 1See more

operaton operaton 1.0.5

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
operaton/operaton:1.0.0-beta-4b35867ffe4d8
nimbus-jose-jwt@9.37.3
9.37.4

Open the chart page →

2,003
dfdeweyosdfir-infrastructureVerified publisher1.0.01 of 3See more

dfdewey osdfir-infrastructure 1.0.0

1 of the 3 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.12.0645d3d9390ad
nimbus-jose-jwt@9.37.3
9.37.4

Open the chart page →

1,190
osdfir-infrastructureosdfir-infrastructureVerified publisher2.15.01 of 40See more

osdfir-infrastructure osdfir-infrastructure 2.15.0

1 of the 40 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
opensearchproject/opensearch:3.1.0474ea3fdf25d
nimbus-jose-jwt@9.48
10.0.2

Open the chart page →

71,208
timesketchosdfir-infrastructureVerified publisher1.0.81 of 6See more

timesketch osdfir-infrastructure 1.0.8

1 of the 6 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
opensearchproject/opensearch:2.14.0466a49f379bb
nimbus-jose-jwt@9.37.3
9.37.4

Open the chart page →

1,753
apache-knox-helmpfisterer-knox0.1.111 of 1See more

apache-knox-helm pfisterer-knox 0.1.11

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
farberg/apache-knox-docker:1.6.14b4a22487394
nimbus-jose-jwt@8.14.1
9.37.4

Open the chart page →

6,237
hive-metastorepresto-loadbalancer0.2.31 of 1See more

hive-metastore presto-loadbalancer 0.2.3

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
datappeal/hive-metastore:lateste38c085a3567
nimbus-jose-jwt@4.41.1
9.37.4

Open the chart page →

9,606
punchline-javapunchplatform8.1.11 of 1See more

punchline-java punchplatform 8.1.1

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
ghcr.io/punchplatform/punchline-java:8.1.1d46ce7b96482
nimbus-jose-jwt@9.8.1
9.37.4

Open the chart page →

1,995
rada-platformrada-platform0.1.02 of 7See more

rada-platform rada-platform 0.1.0

2 of the 7 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
trinodb/trino:45038c6f24ab1a4
nimbus-jose-jwt@9.40
10.0.2
ghcr.io/projectnessie/nessie:0.92.19efe3c74d55f
nimbus-jose-jwt@9.40
10.0.2

Open the chart page →

21,211
mockserverradar-baseVerified publisher5.15.01 of 1See more

mockserver radar-base 5.15.0

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
mockserver/mockserver:mockserver-5.15.00f9ef78c9489
nimbus-jose-jwt@9.28
9.37.4

Open the chart page →

1,257
radar-cp-ksql-serverradar-baseVerified publisher0.0.21 of 2See more

radar-cp-ksql-server radar-base 0.0.2

1 of the 2 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
confluentinc/cp-ksqldb-server:7.6.08ec46c27982f
nimbus-jose-jwt@9.31
9.37.4

Open the chart page →

5,269
radar-kafkaradar-baseVerified publisher0.4.11 of 2See more

radar-kafka radar-base 0.4.1

1 of the 2 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.46.0ac434a48ac2b
nimbus-jose-jwt@9.37.2
9.37.4

Open the chart page →

4,219
radar-mockserverradar-baseVerified publisher0.1.31 of 1See more

radar-mockserver radar-base 0.1.3

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
mockserver/mockserver:mockserver-5.15.00f9ef78c9489
nimbus-jose-jwt@9.28
9.37.4

Open the chart page →

1,257
strimzi-kafka-operatorradar-baseVerified publisher0.46.01 of 1See more

strimzi-kafka-operator radar-base 0.46.0

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
quay.io/strimzi/operator:0.46.0ac434a48ac2b
nimbus-jose-jwt@9.37.2
9.37.4

Open the chart page →

1,951
sonarquberedhat-cop0.1.131 of 1See more

sonarqube redhat-cop 0.1.13

1 of the 1 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
library/sonarqube:10.7.0-community0842dcd4c8f8
nimbus-jose-jwt@9.23
9.37.4

Open the chart page →

4,203
reportportalreportportal5.7.21 of 8See more

reportportal reportportal 5.7.2

1 of the 8 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
reportportal/service-authorization:5.7.09e73114dbd15
nimbus-jose-jwt@9.21
9.37.4

Open the chart page →

25,737
kafkasb-helm-charts0.3.01 of 2See more

kafka sb-helm-charts 0.3.0

1 of the 2 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
provectuslabs/kafka-ui:latest8f2ff02d64b0
nimbus-jose-jwt@9.31
9.37.4

Open the chart page →

1,597
seldon-core-oauth-gatewayseldon0.3.11 of 2See more

seldon-core-oauth-gateway seldon 0.3.1

1 of the 2 container images this version deploys carry CVE-2025-53864.

Container imageDigestPackageFixed in
seldonio/apife:0.3.1eea0d3f578ca
nimbus-jose-jwt@7.3
9.37.4

Open the chart page →

8,098

Container images carrying it

177 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
vlebediantsev/logic-ms:latestdf8bf38c535b
nimbus-jose-jwt@9.22
9.37.4
1
vlebediantsev/registration-ms-final:latest427af418b75e
nimbus-jose-jwt@9.22
9.37.4
1
vlebediantsev/user-data-ms-final-final:latest9319437f3c8f
nimbus-jose-jwt@9.22
9.37.4
1
vrijbrp/haal-centraal-brp-bevragen:develop5c770c2ae48c
nimbus-jose-jwt@9.22
9.37.4
1
wazuh/wazuh-indexer:4.11.1a7a2076b167e
nimbus-jose-jwt@9.40
10.0.2
1
wistefan/mvf:lateste0887302b2d8
nimbus-jose-jwt@9.9
9.37.4
1
gcr.io/spinnaker-marketplace/halyard:1.32.00ee5f968d2ab
nimbus-jose-jwt@6.5.1
9.37.4
1
ghcr.io/data-fair/elasticsearch:7.17.1aa45adaf59a7
nimbus-jose-jwt@9.8.1
9.37.4
1
ghcr.io/fleeksoft/hbase/hbase-base:2.4.13.2c144bdd688d7
nimbus-jose-jwt@4.41.1
9.37.4
1
ghcr.io/fleeksoft/hbase/hdfs:3.3.3.2ac62269785ac
nimbus-jose-jwt@9.8.1
9.37.4
1
ghcr.io/it-at-m/appswitcher-server:1.3.010006bc0f309
nimbus-jose-jwt@9.37.3
9.37.4
1
ghcr.io/it-at-m/kf-app-eai:1.0.65de339b3d537
nimbus-jose-jwt@9.37.3
9.37.4
1
ghcr.io/kafbat/kafka-ui:v1.2.0185da4ad3e88
nimbus-jose-jwt@10.0.1
10.0.2
1
ghcr.io/kubeflow/spark-operator/controller:2.2.1865ff4da5686
nimbus-jose-jwt@9.8.1
9.37.4
1
ghcr.io/melodyyangaws/hive-metastore:3.0.0e949b0f733f0
nimbus-jose-jwt@9.8.1
9.37.4
1
ghcr.io/navikt/mock-oauth2-server:2.1.1065d4ed47ce09
nimbus-jose-jwt@9.40
10.0.2
1
ghcr.io/projectnessie/nessie:0.92.19efe3c74d55f
nimbus-jose-jwt@9.40
10.0.2
1
ghcr.io/punchplatform/punchline-java:8.1.1d46ce7b96482
nimbus-jose-jwt@9.8.1
9.37.4
1
ghcr.io/star-whale/server:0.6.158368359c8dd0
nimbus-jose-jwt@7.9
9.37.4
1
public.ecr.aws/aktosecurity/akto-api-security-mini-testing:improve-testing-performance8e9d15ed71c7
nimbus-jose-jwt@9.37.2
9.37.4
1
public.ecr.aws/v0r6c2e2/hive-metastore:latest794b3bff9510
nimbus-jose-jwt@9.8.1
9.37.4
1
public.ecr.aws/v0r6c2e2/trino:latestc265156b00d1
nimbus-jose-jwt@10.0.1
10.0.2
1
quay.io/fiware/trusted-issuers-registry:0.11.1a8a9ec461034
nimbus-jose-jwt@9.31
9.37.4
1
quay.io/fiware/waltid:1.14.1-SNAPSHOT93889c3d8a34
nimbus-jose-jwt@9.30.2
9.37.4
1
quay.io/maximilianopizarro/workshop-pipelines:lateste383ba3e0966
nimbus-jose-jwt@9.24.4
9.37.4
1
quay.io/strimzi/operator:0.45.158c727cd2e68
nimbus-jose-jwt@9.37.2
9.37.4
1
quay.io/strimzi/operator:0.36.1e9e03b31007c
nimbus-jose-jwt@9.31
9.37.4
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.