Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.

The version of IBM Engineering Requirements Management DOORS (formerly IBM Rational DOORS) installed on the remote host is 9.6.1.1 prior or equal to 9.6.1.13 or 9.7.2.1 prior or equal to 9.7.2.11. It is, therefore, affected by multiple vulnerabilities as referenced in the 7279145 advisory.

  - IBM DOORS Web Access do not limit the length of a connection which could allow for a Slowloris HTTP denial     of service attack to take place. This can cause the web server to become unresponsive. (CVE-2024-25039)

  - IBM DOORS Web Access is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated     attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality     potentially leading to credentials disclosure within a trusted session. (CVE-2025-0152)

  - IBM DOORS Web Access could allow a remote attacker to obtain sensitive information when a detailed     technical error message is returned in the browser. This information could be used in further attacks     against the system. (CVE-2020-4984)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2026 CPU advisory.

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Third Party Jars (Eclipse Jersey)). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and     15.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via     HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Oracle WebLogic Server     accessible data as well as unauthorized access to critical data or complete access to all Oracle WebLogic     Server accessible data. (CVE-2025-12383)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Centralized     Third Party Jars (Apache Commons FileUpload)). Supported versions that are affected are 12.2.1.4.0 and     14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP     to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized     ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle WebLogic Server.
    (CVE-2025-48976)

  - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core (Spring     Framework)). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0.
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to     compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized     access to critical data or complete access to all Oracle WebLogic Server accessible data. (CVE-2025-41249)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle Essbase installed on the remote host is missing a security patch from the October 2025 Critical Patch Update (CPU). It is, therefore, affected by:

  - Vulnerability in Oracle Essbase (component: Security and Provisioning (Bouncy Castle Java Library)). The     supported version that is affected is 21.7.3.0.0. Easily exploitable vulnerability allows unauthenticated     attacker with network access via HTTPS to compromise Oracle Essbase. Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Oracle Essbase. (CVE-2025-8916)

  - Vulnerability in Oracle Essbase (component: Security and Provisioning (Nimbus JOSE+JWT)). The supported     version that is affected is 21.7.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker     with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase,     attacks may significantly impact additional products (scope change). Successful attacks of this     vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of     Oracle Essbase. (CVE-2025-53864)

  - Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is     affected is 21.7.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network     access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in     unauthorized creation, deletion or modification access to critical data or all Oracle Essbase accessible     data as well as unauthorized access to critical data or complete access to all Oracle Essbase accessible     data. (CVE-2025-61763)   Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to     cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of     uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product     could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.
    (CVE-2025-53864)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Connect2id Nimbus JOSE + JWT 10.0.x before 10.0.2 and 9.37.x before 9.37.4 allows a remote attacker to
    cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of
    uncontrolled recursion. NOTE: this is independent of the Gson 2.11.0 issue because the Connect2id product
    could have checked the JSON object nesting depth, regardless of what limits (if any) were imposed by Gson.
    (CVE-2025-53864)

ID	Name	Product	Family	Type	Severity
333335	IBM Engineering Requirements Management DOORS 9.6.1.1 <= 9.6.1.13 / 9.7.2.1 < 9.7.2.11 Multiple Vulnerabilities (7279145)	Nessus	Windows	Local	high
294869	Oracle WebLogic Server (January 2026 CPU)	Nessus	Misc.	Local	critical
271378	Oracle Essbase Multiple Vulnerabilities (October 2025 CPU)	Nessus	Misc.	Local	high
252414	Linux Distros Unpatched Vulnerability : CVE-2025-53864	Nessus	Misc.	Local	medium
428361	SCA: security update for com.nimbusds:nimbus-jose-jwt (GHSA-xwmg-2g98-w7v9)	Tenable Cloud Security	SCA Checks	Local	medium
428361	SCA: security update for com.nimbusds:nimbus-jose-jwt (GHSA-xwmg-2g98-w7v9)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2025-53864

medium

Tenable Plugins

high

critical

high

medium

medium

medium