Resource exhaustion in Authlib
CVE-2025-62706
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt, allowing an attacker who can supply decryptable tokens to exhaust memory and CPU and cause denial of service. This issue has been patched in version 1.6.5. Workarounds for this issue involve rejecting or stripping zip=DEF for inbound JWEs at the application boundary, forking and add a bounded decompression guard via decompressobj().decompress(data, MAX_SIZE)) and returning an error when output exceeds a safe limit, or enforcing strict maximum token sizes and fail fast on oversized inputs; combine with rate limiting.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.005 (37.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 37th percentile — 37.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.005 · change: +0.000
Affected products
- Authlib — versions < 1.6.5
Weakness classification (CWE)
References
- github.com/authlib/authlib/security/advisories/GHSA-g7f3-828f-7h7m (Exploit, Third Party Advisory, Mitigation)
- github.com/authlib/authlib/commit/e0863d5129316b1790eee5f14cece32a03b8184d (Patch)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2025-62706?
- CVE-2025-62706 is a medium-severity vulnerability in Authlib, classified under Uncontrolled Resource Consumption. CVSS score: 6.5/10. Published 2025-10-22.
- How severe is CVE-2025-62706?
- Medium severity. CVSS v3 base score is 6.5 out of 10.