DEBIAN-CVE-2025-61920
Record from OSV · Published October 10, 2025
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.5, Authlib’s JOSE implementation accepts unbounded JWS/JWT header and signature segments. A remote attacker can craft a token whose base64url‑encoded header or signature spans hundreds of megabytes. During verification, Authlib decodes and parses the full input before it is rejected, driving CPU and memory consumption to hostile levels and enabling denial of service. Version 1.6.5 patches the issue. Some temporary workarounds are available. Enforce input size limits before handing tokens to Authlib and/or use application-level throttling to reduce amplification risk.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| python-authlib | Debian:14 | 1.6.5-1 |
| python-authlib | Debian:13 | 1.6.0-1+deb13u1 |
| python-authlib | Debian:12 | 1.2.0-1+deb12u1 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Debian:14 | python-authlib | 1.6.4-1, 0, 1.6.0-1 |
| Debian:13 | python-authlib | 1.6.0-1, 0 |
| Debian:12 | python-authlib | 0, 1.2.0-1 |
Timeline
- Oct 10, 2025 CVE Published
- Oct 23, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln DEBIAN-CVE-2025-61920
vulnetix vdb fixes DEBIAN-CVE-2025-61920Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/DEBIAN-CVE-2025-61920/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart