The Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denial-of-service vulnerability exists in ruby-saml even with the message_max_bytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion. This is fixed in version 1.18.1.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Saml-toolkits |
|
No data.
No data.
References
History
Thu, 31 Jul 2025 10:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Saml-toolkits
Saml-toolkits ruby-saml |
|
| Vendors & Products |
Saml-toolkits
Saml-toolkits ruby-saml |
Wed, 30 Jul 2025 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 30 Jul 2025 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denial-of-service vulnerability exists in ruby-saml even with the message_max_bytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion. This is fixed in version 1.18.1. | |
| Title | Ruby SAML DOS vulnerability with large SAML response | |
| Weaknesses | CWE-400 CWE-770 |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2025-07-30T14:05:43.820Z
Updated: 2025-07-30T14:17:41.057Z
Reserved: 2025-07-25T16:19:16.091Z
Link: CVE-2025-54572
Vulnrichment
Updated: 2025-07-30T14:17:33.379Z
NVD
Status : Awaiting Analysis
Published: 2025-07-30T14:15:29.433
Modified: 2025-07-31T18:42:37.870
Link: CVE-2025-54572
Redhat
No data.