CVE-2025-62706

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt, allowing an attacker who can supply decryptable tokens to exhaust memory and CPU and cause denial of service. This issue has been patched in version 1.6.5. Workarounds for this issue involve rejecting or stripping zip=DEF for inbound JWEs at the application boundary, forking and add a bounded decompression guard via decompressobj().decompress(data, MAX_SIZE)) and returning an error when output exceeds a safe limit, or enforcing strict maximum token sizes and fail fast on oversized inputs; combine with rate limiting.

• CWE-400
• CWE-770

• https://github.com/authlib/authlib/commit/e0863d5129316b1790eee5f14cece32a03b8184dPatch
• https://github.com/authlib/authlib/security/advisories/GHSA-g7f3-828f-7h7mExploit, Mitigation, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2025/10/msg00032.html

Published

Oct 22, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-6270A vulnerability, which was classified as critical, has been …5.3
• CVE-2025-62700Improper Neutralization of Input During Web Page Generation …6.9
• CVE-2025-62701Improper Neutralization of Input During Web Page Generation …6.9
• CVE-2025-62702Improper Neutralization of Input During Web Page Generation …6.9
• CVE-2025-62703Fugue is a unified interface for distributed computing that …8.8
• CVE-2025-62705OpenBao is an open source identity-based secrets management …4.9
• CVE-2025-62707pypdf is a free and open-source pure-python PDF library. Pri…7.5
• CVE-2025-62708pypdf is a free and open-source pure-python PDF library. Pri…7.5
• CVE-2025-62709ClipBucket v5 is an open source video sharing platform. In C…8.8
• CVE-2025-6271A vulnerability, which was classified as problematic, was fo…3.3
• CVE-2025-62710Sakai is a Collaboration and Learning Environment. Prior to …5.9
• CVE-2025-62711Wasmtime is a runtime for WebAssembly. In versions from 38.0…3.1