Dependency convergence failed: nimbus-jose-jwt

[nicwaters823]

Describe the bug

Dependency convergence conflict for com.nimbusds:nimbus-jose-jwt using Spring Security version 3.5.6

To Reproduce

Include in a POM

<dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> <scope>compile</scope> <version>3.5.6</version> </dependency>

and enable Maven enforcer's dependencyConvergence

should see error:
Dependency convergence error for com.nimbusds:nimbus-jose-jwt:jar:9.37.3. Paths to dependency are: +-com.etc.etc.etc:0.0.1-SNAPSHOT +-org.springframework.boot:spring-boot-starter-oauth2-client:jar:3.5.6:compile +-org.springframework.security:spring-security-oauth2-client:jar:6.5.5:compile +-com.nimbusds:oauth2-oidc-sdk:jar:9.43.6:compile +-com.nimbusds:nimbus-jose-jwt:jar:9.37.3:compile and +-ccom.etc.etc.etc:0.0.1-SNAPSHOT +-org.springframework.boot:spring-boot-starter-oauth2-client:jar:3.5.6:compile +-org.springframework.security:spring-security-oauth2-jose:jar:6.5.5:compile +-com.nimbusds:nimbus-jose-jwt:jar:9.37.4:compile

Expected behavior
Enforcer should not find issues

Has occurred before looks like
#13843

[jgrandja]

@nicwaters823 com.nimbusds:nimbus-jose-jwt 9.37.3 is vulnerable to CVE-2025-53864 and therefore was updated to 9.37.4 (gh-17875) in 6.4.11 and 6.5.5.

However, Spring Security 6.5.5 is using com.nimbusds:oauth2-oidc-sdk 9.43.6 which depends on the vulnerable version com.nimbusds:nimbus-jose-jwt 9.37.3, resulting in the Dependency Convergence error.

Unfortunately, com.nimbusds:oauth2-oidc-sdk 9.43.6 is the latest version of the 9.43.x line. This can be resolved if com.nimbusds:oauth2-oidc-sdk 9.43.7 were to be released and included the fixed com.nimbusds:nimbus-jose-jwt 9.37.4. You could request this by logging an issue in OAuth 2.0 SDK Repository. See similar request.

[nicwaters823]

@nicwaters823 com.nimbusds:nimbus-jose-jwt 9.37.3 is vulnerable to CVE-2025-53864 and therefore was updated to 9.37.4 (gh-17875) in 6.4.11 and 6.5.5.

However, Spring Security 6.5.5 is using com.nimbusds:oauth2-oidc-sdk 9.43.6 which depends on the vulnerable version com.nimbusds:nimbus-jose-jwt 9.37.3, resulting in the Dependency Convergence error.

Unfortunately, com.nimbusds:oauth2-oidc-sdk 9.43.6 is the latest version of the 9.43.x line. This can be resolved if com.nimbusds:oauth2-oidc-sdk 9.43.7 were to be released and included the fixed com.nimbusds:nimbus-jose-jwt 9.37.4. You could request this by logging an issue in OAuth 2.0 SDK Repository. See similar request.

thank you. It's not breaking anything in code I'm working on, I just noticed it when updating libraries, and wanted to make someone aware.