Resource exhaustion in authlib - CVE-2025-62706
Published: October 31, 2025
Vulnerability identifier: #VU117880
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-62706
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to Authlib's JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt. A remote user can supply decryptable tokens and exhaust memory and CPU resources, leading to denial of service conditions.
Affected software
authlib
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Python 3 Module
openSUSE Leap
Ubuntu
python-authlib (Ubuntu package)
python311-Authlib
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Python 3 Module
openSUSE Leap
Ubuntu
python-authlib (Ubuntu package)
python311-Authlib
How to mitigate CVE-2025-62706
Install updates from vendor's website.
authlib - update to 1.6.5
python-authlib (Ubuntu package) - addressed in versions 0.15.5-1ubuntu0.1~esm1, 1.3.0-1ubuntu0.1~esm1
python311-Authlib - update to 1.3.1-150600.3.9.1
python-authlib (Ubuntu package) - addressed in versions 0.15.5-1ubuntu0.1~esm1, 1.3.0-1ubuntu0.1~esm1
python311-Authlib - update to 1.3.1-150600.3.9.1