# CVE-2022-36087: oauthlib denial of service in URI validation with malicious IPv6

Source: https://junglewise.ai/threats/cve-2022-36087-oauthlib-denial-of-service-in-uri-validation-with-malicious-ipv6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-09-09. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2022-36087 · Severity: low · CVSS 3.1 · Published 2022-09-09

OAuthlib is a Python library that implements the OAuth 2.0 authentication standard, widely used by web applications to handle user login and authorization flows. A flaw in its URI validation logic allows an attacker to send a specially crafted redirect URI containing malicious IPv6 formatting that causes the server to hang or crash, disrupting service availability for legitimate users.

Technologies: [oauthlib (PyPI)](https://junglewise.ai/threats/technologies/oauthlib). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2022-36087 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-36087 being exploited in the wild.

**How severe is CVE-2022-36087?** Low severity, with a CVSS score of 3.1, published 9 September 2022.

**Which products and versions are affected?** oauthlib (PyPI) ECOSYSTEM:introduced=3.1.1,fixed=3.2.2, GIT:introduced=0,fixed=2e40b412c844ecc4673c3fa3f72181f228bdbacd|ECOSYSTEM:introduced=3.1.1,fixed=3.2.1.

**Is there a fix for CVE-2022-36087?** Yes. oauthlib (PyPI): upgrade to 3.2.1, 3.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2022-36087 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2022-36087?** Check whether you run oauthlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- oauthlib (PyPI): upgrade to 3.2.1, 3.2.2 or later

  ```sh
  pip install "oauthlib>=3.2.2"
  ```


## Technical details

The vulnerability is an input validation flaw (CWE-20) in oauthlib's is_absolute_uri() validation function used to check redirect URIs during OAuth 2.0 provider flows. When an attacker provides a malicious redirect URI with excessive colons formatted as an IPv6 address (e.g., http://[:::::::::::::::::::::::::::::::::::::::]/path), the URI parsing logic enters an infinite loop or consumes excessive CPU/memory, causing a denial of service. The flaw affects applications using OAuth2.0 provider support or directly calling the uri_validate functions. The vulnerability requires low privileges and user interaction (redirect action) but is network-reachable. The issue was fixed in oauthlib version 3.2.2.

## Affected products

- oauthlib oauthlib 3.1.1 to 3.2.1

## Identifiers

- CVE-2022-36087
- GHSA-3pgj-pg6c-r5p7
- PYSEC-2022-269

## Timeline

- 2022-09-09: disclosed: Vulnerability disclosed on NVD
- 2022-09-16: advisory: GitHub security advisory GHSA-3pgj-pg6c-r5p7 published
- 2022-09-16: patched: Fix released in oauthlib 3.2.2

## References

- [https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3pgj-pg6c-r5p7](https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3pgj-pg6c-r5p7)

## Related threats

- [OAuthLib device code grant missing validation](https://junglewise.ai/threats/cve-2026-49272-oauthlib-bearer-token-can-be-retrieved-as-long-as-client-knows-a)
- [OAuthLib client authentication bypass in token grants](https://junglewise.ai/threats/cve-2026-118669-oauthlib-is-an-implementation-of-the-oauth-request-signing-logic)
- [OAuthlib timing attack in PKCE code_verifier comparison](https://junglewise.ai/threats/cve-2026-49265-oauthlib-timing-attack-vulnerability-in-pkce-code-verifier)
- [oauthlib unsafe JSONP callback injection in RevocationEndpoint](https://junglewise.ai/threats/cve-2026-49264-oauthlib-unsafe-jsonp-callback-injection-in-revocationendpoint)