CVE-2025-62706
BaseFortify
Publication date: 2025-10-22
Last updated on: 2025-11-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| authlib | authlib | to 1.6.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Authlib versions prior to 1.6.5, where the JWE zip=DEF path performs unbounded DEFLATE decompression. This means that a very small ciphertext can decompress into a very large amount of data (tens or hundreds of megabytes), allowing an attacker who can supply decryptable tokens to exhaust system memory and CPU resources, causing a denial of service.
How can this vulnerability impact me? :
The vulnerability can lead to denial of service by exhausting memory and CPU resources when processing specially crafted tokens. This can degrade or disrupt the availability of services relying on Authlib for OAuth or OpenID Connect token processing.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by identifying if your system is using Authlib versions prior to 1.6.5 that perform unbounded DEFLATE decompression on JWE tokens with zip=DEF. Detection involves checking the Authlib version in use and monitoring for unusually large decompression operations or memory/CPU exhaustion during token processing. Specific commands are not provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading Authlib to version 1.6.5 or later where the issue is patched; rejecting or stripping the zip=DEF parameter for inbound JWEs at the application boundary; implementing a bounded decompression guard using decompressobj().decompress(data, MAX_SIZE) to limit decompression output size and return an error if exceeded; enforcing strict maximum token sizes and failing fast on oversized inputs; and combining these with rate limiting to reduce the risk of denial of service.