ruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responses
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses. ruby-saml uses zlib to decompress SAML responses in case they're compressed. It is possible to bypass the message size check with a compressed assertion since the message size is checked before inflation and not after. This issue may lead to remote Denial of Service (DoS). Versions 1.12.4 and 1.18.0 fix the issue.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-25293US | high7.5 | — | ||
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote Denial of Servic… | ||||
references
External citations — patches, advisories, analysis.
- https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-releasedFIX
- https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentialsADVISORY
- https://github.com/SAML-Toolkits/ruby-saml/commit/acac9e9cc0b9a507882c614f25d41f8b47be349aFIX
- https://github.com/SAML-Toolkits/ruby-saml/commit/e2da4c6dae7dc01a4d9cd221395140a67e2b3eb1FIX
- https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4ARTICLE
- https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.0ARTICLE
- https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-92rq-c8cf-prrqADVISORY
- https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xvADVISORY
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan