Threats tagged 'ghsa-g7f3-828f-7h7m'

Authlib versions prior to 1.6.5 contain a vulnerability in the JWE 'zip=DEF' decompression handling that allows unbounded DEFLATE decompression. This can be exploited by an attacker who can supply decryptable tokens to cause excessive memory and CPU usage, resulting in denial of service. The issue arises because the decompression function does not enforce a maximum output size, allowing a small compressed ciphertext to expand into very large plaintext during decryption. No confidentiality or integrity impact is reported, but availability is severely affected. A fix is available in Authlib 1.6.5.