{"id":"CVE-2026-85473","revision":"43f220e849fa41f9a84ea2da2bef70ca","records":[{"revision":"43f220e849fa41f9a84ea2da2bef70ca","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-85473","aliases":[],"title":"Out-of-Range Timestamp Claim Handling in auth0/java-jwt","description":"The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value. The condition occurs during token parsing, prior to signature verification. Repeated requests of this nature may lead to degraded availability of the affected service.","state":0,"publishedAt":"2026-10-13T20:08:56.332+00:00","modifiedAt":"2026-10-16T15:31:55.1+00:00","affected":[{"ecosystem":"Vendor product","name":"java-jwt","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Auth0\",\n                    \"product\": \"java-jwt\",\n                    \"versions\": [\n                        {\n                            \"version\": \"4.0.0\",\n                            \"status\": \"affected\",\n                            \"lessThan\": \"4.6.2\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","score":5.3,"severity":"MEDIUM"}],"references":["https://trust.okta.com/security-advisories/out-of-range-timestamp-claim-handling-in-auth0-java-jwt-cve-2026-85473","https://github.com/auth0/java-jwt/security/advisories/GHSA-cg7w-5cc2-f2xm"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-85473","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-85473","identifiers":["CVE-2026-85473"]},"retained":false,"historicalAffected":[]}],"coverage":[]}