Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand into tens or hundreds of megabytes on decrypt, allowing an attacker who can supply decryptable tokens to exhaust memory and CPU and cause denial of service. This issue has been patched in version 1.6.5. Workarounds for this issue involve rejecting or stripping zip=DEF for inbound JWEs at the application boundary, forking and add a bounded decompression guard via decompressobj().decompress(data, MAX_SIZE)) and returning an error when output exceeds a safe limit, or enforcing strict maximum token sizes and fail fast on oversized inputs; combine with rate limiting.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:3842-1 advisory.

    - CVE-2025-62706: fixed a denial of service condition  (bsc#1252504, gh#authlib/authlib@e0863d512931)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4352 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4352-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Daniel Leidert     October 29, 2025                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : python-authlib     Version        : 0.15.4-1+deb11u1     CVE ID         : CVE-2024-37568 CVE-2025-59420 CVE-2025-61920 CVE-2025-62706


    Multiple vulnerabilities have been found in python-authlib, a Python     library for OAuth and OpenID Connect servers.

    CVE-2024-37568

        Unless an algorithm is specified in a jwt.decode call, HMAC verification         is allowed with any asymmetric public key.

    CVE-2025-59420

        Authlibs JWS verification accepts tokens that declare unknown critical         header parameters (crit), violating RFC 7515 mustunderstand semantics.
        An attacker can craft a signed token with a critical header that strict         verifiers reject but Authlib accepts. In mixedlanguage fleets, this         enables splitbrain verification and can lead to policy bypass, replay,         or privilege escalation.

    CVE-2025-61920

        Authlibs JOSE implementation accepts unbounded JWS/JWT header and         signature segments which can lead to a DoS during verification.

    CVE-2025-62706

        Authlibs JWE zip=DEF path performs unbounded DEFLATE decompression         which can lead to a DoS.


    For Debian 11 bullseye, these problems have been fixed in version     0.15.4-1+deb11u1.

    We recommend that you upgrade your python-authlib packages.

    For the detailed security status of python-authlib please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/python-authlib

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5,     Authlib's JWE zip=DEF path performs unbounded DEFLATE decompression. A very small ciphertext can expand     into tens or hundreds of megabytes on decrypt, allowing an attacker who can supply decryptable tokens to     exhaust memory and CPU and cause denial of service. This issue has been patched in version 1.6.5.
    Workarounds for this issue involve rejecting or stripping zip=DEF for inbound JWEs at the application     boundary, forking and add a bounded decompression guard via decompressobj().decompress(data, MAX_SIZE))     and returning an error when output exceeds a safe limit, or enforcing strict maximum token sizes and fail     fast on oversized inputs; combine with rate limiting. (CVE-2025-62706)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
271948	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-Authlib (SUSE-SU-2025:3842-1)	Nessus	SuSE Local Security Checks	medium
271941	Debian dla-4352 : python-authlib-doc - security update	Nessus	Debian Local Security Checks	high
271720	Linux Distros Unpatched Vulnerability : CVE-2025-62706	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-62706

medium

Tenable Plugins

medium

high

medium