The vulnerability identified as CVE-2025-62706 affects the Authlib library's JSON Web Encryption (JWE) handling when using zip=DEF compression. In versions prior to 1.6.5, Authlib performs unbounded DEFLATE decompression without limiting the output size, enabling an attacker who can supply decryptable tokens to create compressed JWE ciphertexts that expand to arbitrarily large sizes. This results in excessive resource consumption (CPU and memory), leading to denial of service. This vulnerability is present in the Red Hat Satellite MCP server container image (foreman-mcp-server-rhel9) for version 6.18. Red Hat has not released a patch or fix for this issue as of the advisory date, and mitigation options are limited or do not meet Red Hat's criteria for widespread deployment.

The vulnerability can cause denial of service by exhausting system resources such as memory and CPU when processing specially crafted JWE tokens with zip=DEF compression. This impacts the availability of the affected Red Hat Satellite MCP server component. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild at this time.

Currently, no official fix or patch is available for this vulnerability that meets Red Hat's criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for updates. Since the vulnerability involves processing of decryptable JWE tokens, restricting or validating input tokens where possible may reduce exposure. Customers with a Technical Account Manager (TAM) can consult directly with Red Hat for tailored guidance. Upgrading to a fixed version when available is recommended once released.