CVE-2025-54572
Ruby SAML DOS vulnerability with large SAML response
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Ruby SAML DOS vulnerability with large SAML response
The Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denial-of-service vulnerability exists in ruby-saml even with the message_max_bytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion. This is fixed in version 1.18.1.
Reserved 2025-07-25 | Published 2025-07-30 | Updated 2025-07-30 | Assigner GitHub_MCWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling
github.com/...y-saml/security/advisories/GHSA-rrqh-93c8-j966
github.com/SAML-Toolkits/ruby-saml/pull/770
github.com/...ommit/38ef5dd1ce17514e202431f569c4f5633e6c2709
github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.1
Support options
