Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2025-25293: ruby-saml can be crashed by compressed SAML responses
CVE-2025-25293 · published 1 year ago
Summary
The ruby-saml library used for single sign‑on can be forced to stop working when it receives specially crafted compressed messages. An attacker could cause the service that relies on this library to become unavailable. Update ruby-saml to version 1.12.4, 1.18.0, or any later release to fix the problem.
What to do
- Update saml toolkit ruby-saml to version 1.12.4.
- Update saml toolkit ruby-saml to version 1.18.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rubygems | saml toolkit | ruby-saml |
< 1.12.4 >= 1.13.0, < 1.18.0 Fix: upgrade to 1.12.4
|
| – | omniauth | omniauth_saml |
< 1.10.6 >= 2.0.0, < 2.1.3 >= 2.2.0, < 2.2.3 cpe:2.3:a:omniauth:omniauth_saml:*:*:*:*:*:ruby:*:* |
| – | onelogin | ruby-saml |
< 1.12.4 >= 1.13.0, < 1.18.0 cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:* |
Original advisory text
ruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responses
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses. ruby-saml uses zlib to decompress SAML responses in case they're compressed. It is possible to bypass the message size check with a compressed assertion since the message size is checked before inflation and not after. This issue may lead to remote Denial of Service (DoS). Versions 1.12.4 and 1.18.0 fix the issue.
References
- https://security.netapp.com/advisory/ntap-20250314-0008/ Vendor Advisory
- https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.0 URL
- https://lists.debian.org/debian-lts-announce/2025/04/msg00011.html URL
- https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-release... URL
- https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4 URL
- https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-92rq-c8cf-pr... Vendor Advisory
- https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9x... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-25293 Vendor Advisory
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/CVE-2025-...
- https://security.netapp.com/advisory/ntap-20250314-0008
- https://github.com/advisories/GHSA-92rq-c8cf-prrq
- https://securitylab.github.com/advisories/GHSL-2024-355_ruby-saml Vendor Advisory
- https://github.com/SAML-Toolkits/ruby-saml/commit/acac9e9cc0b9a507882c614f25d41f... Patch
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25293... Vendor Advisory
- https://github.com/SAML-Toolkits/ruby-saml/commit/e2da4c6dae7dc01a4d9cd221395140... Patch
- https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication... Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
8.3
High
Type
CWE-400Uncontrolled Resource Consumption
CWE-770Allocation of Resources Without Limits
Timeline
Published12 Mar 2025
Updated31 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta