{"cve":"CVE-2025-62706","nvd":{"published":"2025-10-22T22:15:35.557","modified":"2026-10-19T13:10:00.110","status":"Modified","description":"Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt, allowing an attacker who can supply decryptable tokens to exhaust memory and CPU and cause denial of service. This issue has been patched in version 1.6.5. Workarounds for this issue involve rejecting or stripping zip=DEF for inbound JWEs at the application boundary, forking and add a bounded decompression guard via decompressobj().decompress(data, MAX_SIZE)) and returning an error when output exceeds a safe limit, or enforcing strict maximum token sizes and fail fast on oversized inputs; combine with rate limiting.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5},"cwes":["CWE-400","CWE-770"],"references":["https://github.com/authlib/authlib/commit/e0863d5129316b1790eee5f14cece32a03b8184d","https://github.com/authlib/authlib/security/advisories/GHSA-g7f3-828f-7h7m","https://lists.debian.org/debian-lts-announce/2025/10/msg00032.html"],"products":["authlib:authlib"],"source":"nvd","synced_at":"2026-10-19T22:12:35.277909958+00:00"},"epss":{"cve":"CVE-2025-62706","score":0.00458,"percentile":0.39462,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-g7f3-828f-7h7m","url":"https://osv.dev/vulnerability/GHSA-g7f3-828f-7h7m","summary":"Authlib : JWE zip=DEF decompression bomb enables DoS","modified":"2026-09-10T03:50:29.792893044Z","packages":[{"ecosystem":"PyPI","name":"authlib","purl":"pkg:pypi/authlib","ranges":["<1.6.5"],"fixed":["1.6.5"]}]},{"id":"PYSEC-2026-1202","url":"https://osv.dev/vulnerability/PYSEC-2026-1202","summary":"Authlib : JWE zip=DEF decompression bomb enables DoS","modified":"2026-07-07T17:46:32.698664924Z","packages":[{"ecosystem":"PyPI","name":"authlib","purl":"pkg:pypi/authlib","ranges":["<1.6.5"],"fixed":["1.6.5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}