Authlib's JOSE implementation accepts unbounded JWS/JWT header and signature segments, allowing a remote attacker to craft tokens with extremely large base64url-encoded header or signature segments. During token verification, Authlib decodes and parses the entire input before rejecting it, causing high CPU and memory usage that can exhaust service capacity and cause denial of service. The vulnerability affects Authlib versions up to 1.6.3. The issue is mitigated in later versions by enforcing a 256 KB limit on decoded header and signature segment sizes.

An unauthenticated network attacker can submit malicious JWS/JWT tokens with oversized header or signature segments, causing the Authlib verification process to consume excessive CPU and memory resources. This can lead to denial of service by exhausting the target service's capacity. The CVSS v3.1 score is 7.5 (High), reflecting the ease of attack and impact on availability without affecting confidentiality or integrity.

A patch is available that enforces maximum decoded size limits of 256 KB on JWS/JWT header and signature segments in Authlib. Users should upgrade to a patched release immediately. As additional defense, inputs exceeding a few kilobytes should be rejected at proxy or WAF layers, and rate limiting should be applied to verification endpoints. Temporary workarounds include enforcing input size limits before token processing and applying application-level throttling to reduce amplification risk.