The vulnerability in the Auth0 Java JWT library allows an attacker to terminate a server thread by sending a JSON Web Token with a timestamp claim (exp, nbf, iat) that contains an out‑of‑range value. The failure occurs during parsing, before signature verification, and can cause the affected service to become unresponsive. The weakness is a classic input validation error (CWE‑20) compounded by improper bound checking (CWE‑755). The impact is a degradation of availability, rather than data disclosure or compromise of integrity.

Applications that incorporate the Auth0 java-jwt library, specifically the Auth0:java-jwt product, are affected when using any version prior to 4.6.2. No other vendors or product lines are listed in the CNA data.

Based on the description, it is inferred that the attack vector is an application that parses JWTs exposed to external requests. The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% implies a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack requires an application that parses JWTs to be exposed to external requests; by sending repeated crafted tokens, an attacker can trigger the thread termination and lead to a denial‑of‑service state. Because the issue arises before any signature checks, there is no credential escalation or data theft risk.