# CVE-2025-62706: PYSEC-2026-1202 - Authlib : JWE zip=DEF decompression bomb enables DoS

Source: https://junglewise.ai/threats/cve-2025-62706-authlib-jwe-zip-def-decompression-bomb-enables-dos  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-22  
License: CC BY 4.0 with a link back

CVE-2025-62706 · Severity: medium · CVSS 6.5 · Published 2025-10-22

Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt, allowing an attacker who can supply decryptable tokens to exhaust memory and CPU and cause denial of service. This issue has been patched in version 1.6.5. Workarounds for this issue involve rejecting or stripping zip=DEF for inbound JWEs at the application boundary, forking and add a bounded decompression guard via decompressobj().decompress(data, MAX_SIZE)) and returning an error when output exceeds a safe limit, or enforcing strict maximum token sizes and fail fast on oversized inputs; combine with rate limiting.

Technologies: [Authlib](https://junglewise.ai/threats/technologies/authlib-authlib), [authlib (PyPI)](https://junglewise.ai/threats/technologies/authlib). Vendors: [Authlib](https://junglewise.ai/threats/vendors/authlib), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-62706 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-62706 being exploited in the wild.

**How severe is CVE-2025-62706?** Medium severity, with a CVSS score of 6.5, published 22 October 2025.

**Which products and versions are affected?** authlib (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.5.

**Is there a fix for CVE-2025-62706?** Yes. authlib (PyPI): upgrade to 1.6.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-62706?** Check whether you run Authlib or authlib (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- authlib (PyPI): upgrade to 1.6.5 or later

  ```sh
  pip install "authlib>=1.6.5"
  ```


## Affected products

- Authlib
- authlib (PyPI) ECOSYSTEM:introduced=0,fixed=1.6.5

## Identifiers

- CVE-2025-62706
- GHSA-g7f3-828f-7h7m
- PYSEC-2026-1202

## Related threats

- [Authlib client configuration endpoint authorization bypass](https://junglewise.ai/threats/cve-2026-116672-authlib-is-a-python-library-which-builds-oauth-and-openid)
- [Authlib RFC 9101 server-side request forgery in request_uri parameter](https://junglewise.ai/threats/cve-2026-114620-authlib-is-a-python-library-which-builds-oauth-and-openid)
- [Authlib OpenID Connect scope validation bypass](https://junglewise.ai/threats/cve-2026-114619-authlib-is-a-python-library-which-builds-oauth-and-openid)
- [Authlib JWT Bearer Grant audience validation bypass](https://junglewise.ai/threats/cve-2026-114618-authlib-is-a-python-library-which-builds-oauth-and-openid)
- [Authlib nonce validation bypass in OpenID token parsing](https://junglewise.ai/threats/cve-2026-114617-authlib-is-a-python-library-which-builds-oauth-and-openid)