TI-2025-36973 CVE-2025-59420 · GHSA-9ggr-2464-2j32
Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)
Priority HIGH 72
Authlib is a Python library which builds OAuth and OpenID Connect servers.
RHSA-2025:23176
Red Hat Quay 3.13.10
Released 2025-12-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Quay 3.13 registry.redhat.io/quay/quay-builder-rhel8, registry.redhat.io/quay/quay-container-security-operator-rhel8, registry.redhat.io/quay/quay-rhel8
Fixes 4 records
TI-2024-22606 CVE-2024-34156 · GHSA-crqm-pwhx-j97f
Stack exhaustion in Decoder.Decode in encoding/gob
Priority MEDIUM 41
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion.
TI-2025-30317 CVE-2025-47913 · GHSA-56w8-48fp-6mgv
Potential denial of service in golang.org/x/crypto/ssh/agent
Priority MEDIUM 40
SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.
TI-2025-38269 CVE-2025-61920 · GHSA-pq5p-34cr-23v9
Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
Priority LOW 34
Authlib is a Python library which builds OAuth and OpenID Connect servers.