CVE-2025-62706

    Dashboard / Vulnerabilities / CVE-2025-62706

    CVE-2025-62706

    Published: 22 Oct 2025Last Modified: 12 Aug 2026

    Summary: Authlib : JWE zip=DEF decompression bomb enables DoS

    Details: Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt, allowing an attacker who can supply decryptable tokens to exhaust memory and CPU and cause denial of service. This issue has been patched in version 1.6.5. Workarounds for this issue involve rejecting or stripping zip=DEF for inbound JWEs at the application boundary, forking and add a bounded decompression guard via decompressobj().decompress(data, MAX_SIZE)) and returning an error when output exceeds a safe limit, or enforcing strict maximum token sizes and fail fast on oversized inputs; combine with rate limiting.

    References: https://lists.debian.org/debian-lts-announce/2025/10/msg00032.html, https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62706.json, https://github.com/authlib/authlib/security/advisories/GHSA-g7f3-828f-7h7m, https://nvd.nist.gov/vuln/detail/CVE-2025-62706, https://github.com/authlib/authlib/commit/e0863d5129316b1790eee5f14cece32a03b8184d

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -9ec42561cd1a81b518598d252f8adbcf446f7419

    Affected versions

    v1.6.4
    v1.6.3
    v1.6.2
    v1.6.1
    v1.6.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2025-62706 | CVE-DB