Authlib versions up to 1.6.3 have a vulnerability in their JOSE implementation where unbounded JWS/JWT header and signature segments can be oversized. An attacker can submit tokens with base64url-encoded segments hundreds of megabytes in size, causing excessive CPU and memory usage during verification and resulting in denial of service. The issue is fixed in version 1.6.5 by enforcing a 256 KB size limit on these segments.