Unbounded DEFLATE Decompression Vulnerability in Authlib Python Library

CVE-2025-62706

What is CVE-2025-62706?

Authlib, a Python library utilized for building OAuth and OpenID Connect servers, has a significant vulnerability associated with its handling of JWE tokens. Specifically, prior to version 1.6.5, the library's implementation allows for unbounded DEFLATE decompression when the zip=DEF parameter is present. This weakness enables attackers to craft small ciphertexts that can expand excessively upon decryption, potentially leading to substantial memory and CPU resource consumption and resulting in denial-of-service (DoS) conditions. Users are encouraged to upgrade to version 1.6.5 or implement recommended workarounds, such as rejecting or modifying inbound JWEs with zip=DEF at the application boundary, applying bounded decompression techniques, and enforcing strict input limits combined with rate limiting to mitigate this risk.

References