Threats tagged 'brew-fastmcp-cve-2025-62706'

Authlib's JWE implementation with 'zip=DEF' (DEFLATE) decompression performs unbounded decompression without limits, allowing a small compressed ciphertext to expand into very large plaintext during decryption. This can cause excessive memory and CPU usage, leading to denial of service. The vulnerability affects services that decrypt JWE tokens with 'zip=DEF' where attackers can supply decryptable tokens. No confidentiality or integrity impact is reported, but availability is severely affected. A fix is available in version 2.12.4_1. Until patched, rejecting or stripping 'zip=DEF' tokens is recommended.