CVE-2025-62706 Details
Description
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt, allowing an attacker who can supply decryptable tokens to exhaust memory and CPU and cause denial of service. This issue has been patched in version 1.6.5. Workarounds for this issue involve rejecting or stripping zip=DEF for inbound JWEs at the application boundary, forking and add a bounded decompression guard via decompressobj().decompress(data, MAX_SIZE)) and returning an error when output exceeds a safe limit, or enforcing strict maximum token sizes and fail fast on oversized inputs; combine with rate limiting.
A denial-of-service vulnerability has been identified in Authlib, a Python library for building OAuth and OpenID Connect servers. Prior to version 1.6.5, the library's JWE zip=DEF path allowed unbounded DEFLATE decompression. This flaw could be exploited by an attacker who can provide decryptable tokens, causing a small ciphertext to expand into tens or hundreds of megabytes upon decryption. This excessive expansion can lead to memory and CPU exhaustion, causing a denial-of-service condition.
Users are advised to update to Authlib version 1.6.5 or later. For those unable to update, JWE tokens with 'zip=DEF' should be rejected or stripped at the application level. A bounded decompression guard can be added to the JWE processing logic, returning an error if the decompressed output exceeds a safe limit. Additionally, strict maximum token sizes should be enforced, with rate limiting applied to mitigate potential abuse.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 23, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://lists.debian.org/debian-lts-announce/2025/10/msg00032.html | CVE | |
| https://github.com/authlib/authlib/commit/e0863d5129316b1790eee5f14cece32a03b8184d | [email protected] | Patch |
| https://github.com/authlib/authlib/security/advisories/GHSA-g7f3-828f-7h7m | [email protected] | ExploitMitigationThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| authlib authlib | < 1.6.5 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2025 | CVE Modified | CVE |
| Oct 30, 2025 | Initial Analysis | [email protected] |
| Oct 22, 2025 | New CVE Received | [email protected] |