CVE-2025-46404
A denial of service vulnerability exists in the lasso_provider_verify_saml_signature...
A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
7.5
A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.
- Record
CVE-2025-46404- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
EUVDEUVD-2025-37770
7.5
A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.
- Record
EUVD-2025-37770- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2vvf-4m7q-pvpx
9.6
A denial of service vulnerability exists in the lasso_provider_verify_saml_signature...
A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.
- Record
GHSA-2vvf-4m7q-pvpx- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
NVD
7.5
A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.
- Record
CVE-2025-46404- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
OSV
7.5
A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.
- Record
CVE-2025-46404- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-46404
7.5
A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.
- Record
DEBIAN-CVE-2025-46404- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 14 moreShow less
OSVOESA-2025-2662
9.8
lasso security update
The package is a implements the Liberty Alliance Single Sign On standards library, includeing the SAML2 and SAML specifications. it provides bindings for multiple languages.and allows to handle the whole life-cycle of SAML based Federations.
Security Fix(es):
A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.(CVE-2025-46404)
A denial of service vulnerability exists in the g_assert_not_reached functionality of Entr ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML assertion response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.(CVE-2025-46705)
A denial of service vulnerability exists in the lasso_node_init_from_message_with_format functionality of Entr ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a memory depletion, resulting in denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.(CVE-2025-46784)
A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML response can lead to an arbitrary code execution. An attacker can send a malformed SAML response to trigger this vulnerability.(CVE-2025-47151)
- Record
OESA-2025-2662- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-2663
9.8
lasso security update
The package is a implements the Liberty Alliance Single Sign On standards library, includeing the SAML2 and SAML specifications. it provides bindings for multiple languages.and allows to handle the whole life-cycle of SAML based Federations.
Security Fix(es):
A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.(CVE-2025-46404)
A denial of service vulnerability exists in the g_assert_not_reached functionality of Entr ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML assertion response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.(CVE-2025-46705)
A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML response can lead to an arbitrary code execution. An attacker can send a malformed SAML response to trigger this vulnerability.(CVE-2025-47151)
- Record
OESA-2025-2663- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-2664
9.8
lasso security update
The package is a implements the Liberty Alliance Single Sign On standards library, includeing the SAML2 and SAML specifications. it provides bindings for multiple languages.and allows to handle the whole life-cycle of SAML based Federations.
Security Fix(es):
A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.(CVE-2025-46404)
A denial of service vulnerability exists in the g_assert_not_reached functionality of Entr ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML assertion response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.(CVE-2025-46705)
A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML response can lead to an arbitrary code execution. An attacker can send a malformed SAML response to trigger this vulnerability.(CVE-2025-47151)
- Record
OESA-2025-2664- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-2665
9.8
lasso security update
The package is a implements the Liberty Alliance Single Sign On standards library, includeing the SAML2 and SAML specifications. it provides bindings for multiple languages.and allows to handle the whole life-cycle of SAML based Federations.
Security Fix(es):
A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.(CVE-2025-46404)
A denial of service vulnerability exists in the g_assert_not_reached functionality of Entr ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML assertion response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.(CVE-2025-46705)
A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML response can lead to an arbitrary code execution. An attacker can send a malformed SAML response to trigger this vulnerability.(CVE-2025-47151)
- Record
OESA-2025-2665- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2025-2666
9.8
lasso security update
The package is a implements the Liberty Alliance Single Sign On standards library, includeing the SAML2 and SAML specifications. it provides bindings for multiple languages.and allows to handle the whole life-cycle of SAML based Federations.
Security Fix(es):
A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.(CVE-2025-46404)
A denial of service vulnerability exists in the g_assert_not_reached functionality of Entr ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML assertion response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.(CVE-2025-46705)
A denial of service vulnerability exists in the lasso_node_init_from_message_with_format functionality of Entr ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a memory depletion, resulting in denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.(CVE-2025-46784)
A type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality of Entr'ouvert Lasso 2.5.1 and 2.8.2. A specially crafted SAML response can lead to an arbitrary code execution. An attacker can send a malformed SAML response to trigger this vulnerability.(CVE-2025-47151)
- Record
OESA-2025-2666- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-46404
7.5
A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.
- Record
UBUNTU-CVE-2025-46404- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-69841 No score
CVE-2025-46404 affecting package lasso for versions less than 2.9.0-1
A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.
- Record
AZL-69841- Updated
- 2026-11-02
OSVAZL-69854 No score
CVE-2025-46404 affecting package lasso 2.8.0-1
A denial of service vulnerability exists in the lasso_provider_verify_saml_signature functionality of Entr'ouvert Lasso 2.5.1. A specially crafted SAML response can lead to a denial of service. An attacker can send a malformed SAML response to trigger this vulnerability.
- Record
AZL-69854- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:20083-1 No score
Security update for lasso
This update for lasso fixes the following issues:
- CVE-2025-46404: specially crafted SAML response can lead to a denial of service (bsc#1253092).
- CVE-2025-46705: specially crafted SAML assertion response can lead to a denial of service (bsc#1253093).
- CVE-2025-47151: type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality can lead to an arbitrary code execution (bsc#1253095).
- Record
openSUSE-SU-2025:20083-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:21140-1 No score
Security update for lasso
This update for lasso fixes the following issues:
- CVE-2025-46404: specially crafted SAML response can lead to a denial of service (bsc#1253092).
- CVE-2025-46705: specially crafted SAML assertion response can lead to a denial of service (bsc#1253093).
- CVE-2025-47151: type confusion vulnerability exists in the lasso_node_impl_init_from_xml functionality can lead to an arbitrary code execution (bsc#1253095).
- Record
SUSE-SU-2025:21140-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:4068-1 No score
Security update for lasso
This update for lasso fixes the following issues:
- CVE-2025-46404: Fixed denial of service in Entr'ouvert Lasso (bsc#1253092)
- CVE-2025-46705: Fixed denial of service in Entr'ouvert Lasso (bsc#1253093)
- CVE-2025-47151: Fixed type confusion vulnerability in the lasso_node_impl_init_from_xml functionality (bsc#1253095)
- Record
SUSE-SU-2025:4068-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:4090-1 No score
Security update for lasso
This update for lasso fixes the following issues:
- CVE-2025-46784: Fixed memory exhaustion in Entr'ouvert Lasso (bsc#1253094)
- CVE-2025-46404: Fixed denial of service in Entr'ouvert Lasso (bsc#1253092)
- CVE-2025-46705: Fixed denial of service in Entr'ouvert Lasso (bsc#1253093)
- CVE-2025-47151: Fixed type confusion vulnerability in the lasso_node_impl_init_from_xml functionality (bsc#1253095)
- Record
SUSE-SU-2025:4090-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:4094-1 No score
Security update for lasso
This update for lasso fixes the following issues:
- CVE-2025-46784: Fixed memory exhaustion in Entr'ouvert Lasso (bsc#1253094)
- CVE-2025-46404: Fixed denial of service in Entr'ouvert Lasso (bsc#1253092)
- CVE-2025-46705: Fixed denial of service in Entr'ouvert Lasso (bsc#1253093)
- CVE-2025-47151: Fixed type confusion vulnerability in the lasso_node_impl_init_from_xml functionality (bsc#1253095)
- Record
SUSE-SU-2025:4094-1- Updated
- 2026-11-02
OSVUSN-7872-1 No score
lasso vulnerabilities
It was discovered that Lasso incorrectly handled certain malformed SAML responses. A remote attacker could possibly use this issue to cause Lasso to crash, resulting in a denial of service. (CVE-2025-46404)
It was discovered that Lasso incorrectly handled certain malformed SAML assertion responses. A remote attacker could possibly use this issue to cause Lasso to crash, resulting in a denial of service. (CVE-2025-46705)
It was discovered that Lasso incorrectly handled certain malformed SAML responses. A remote attacker could possibly use this issue to cause Lasso to consume memory, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2025-46784)
It was discovered that Lasso incorrectly handled certain malformed SAML responses. A remote attacker could use this issue to cause Lasso to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2025-47151)
- Record
USN-7872-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lassoAzure Linux:3 |
before 2.9.0-1 | 2.9.0-1 |
lassoAzure Linux:2 |
through 2.8.0-1 | None known |
lassoDebian:12 |
before 2.8.1-1+deb12u1, plus listed versions 2.8.1-1 |
2.8.1-1+deb12u1 |
lassoDebian:13 |
before 2.8.2-9+deb13u1, plus listed versions 2.8.2-9 |
2.8.2-9+deb13u1 |
lassoDebian:14 |
before 2.9.0-1, plus listed versions 2.8.2-9 |
2.9.0-1 |
lassoDebian:11 From an advisory covering 4 CVEs |
before 2.6.1-3+deb11u1, plus listed versions 2.6.1-3 |
2.6.1-3+deb11u1 |
lassoDebian:12 From an advisory covering 3 CVEs |
before 2.8.1-1+deb12u1, plus listed versions 2.8.1-1 |
2.8.1-1+deb12u1 |
lassoDebian:13 From an advisory covering 3 CVEs |
before 2.8.2-9+deb13u1, plus listed versions 2.8.2-9 |
2.8.2-9+deb13u1 |
lassoopenEuler:22.03-LTS-SP4 From an advisory covering 4 CVEs |
before 2.7.0-2.oe2203sp4 | 2.7.0-2.oe2203sp4 |
lassoopenEuler:24.03-LTS From an advisory covering 3 CVEs |
before 2.8.2-3.oe2403 | 2.8.2-3.oe2403 |
Show 34 moreShow less
| Package | Affected | Fixed |
|---|---|---|
lassoopenEuler:24.03-LTS-SP1 From an advisory covering 3 CVEs |
before 2.8.2-3.oe2403sp1 | 2.8.2-3.oe2403sp1 |
lassoopenEuler:24.03-LTS-SP2 From an advisory covering 3 CVEs |
before 2.8.2-3.oe2403sp2 | 2.8.2-3.oe2403sp2 |
lassoopenEuler:22.03-LTS-SP3 From an advisory covering 4 CVEs |
before 2.7.0-2.oe2203sp3 | 2.7.0-2.oe2203sp3 |
lassoSUSE:Linux Enterprise Server 16.0 From an advisory covering 3 CVEs |
before 2.8.2-160000.3.1 | 2.8.2-160000.3.1 |
lassoSUSE:Linux Enterprise Server for SAP applications 16.0 From an advisory covering 3 CVEs |
before 2.8.2-160000.3.1 | 2.8.2-160000.3.1 |
lassoSUSE:Linux Enterprise Module for Package Hub 15 SP6 From an advisory covering 3 CVEs |
before 2.8.2-150600.3.5.1 | 2.8.2-150600.3.5.1 |
lassoSUSE:Linux Enterprise Module for Package Hub 15 SP7 From an advisory covering 3 CVEs |
before 2.8.2-150600.3.5.1 | 2.8.2-150600.3.5.1 |
lassoSUSE:Linux Enterprise Module for Server Applications 15 SP6 From an advisory covering 3 CVEs |
before 2.8.2-150600.3.5.1 | 2.8.2-150600.3.5.1 |
lassoSUSE:Linux Enterprise Module for Server Applications 15 SP7 From an advisory covering 3 CVEs |
before 2.8.2-150600.3.5.1 | 2.8.2-150600.3.5.1 |
lassoopenSUSE:Leap 15.6 From an advisory covering 3 CVEs |
before 2.8.2-150600.3.5.1 | 2.8.2-150600.3.5.1 |
lassoSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 4 CVEs |
before 2.6.1-150200.24.1 | 2.6.1-150200.24.1 |
lassoSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 4 CVEs |
before 2.6.1-150200.24.1 | 2.6.1-150200.24.1 |
lassoSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 4 CVEs |
before 2.6.1-150200.24.1 | 2.6.1-150200.24.1 |
lassoSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 4 CVEs |
before 2.6.1-150200.24.1 | 2.6.1-150200.24.1 |
lassoSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 4 CVEs |
before 2.6.1-150200.24.1 | 2.6.1-150200.24.1 |
lassoSUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 4 CVEs |
before 2.6.1-150200.24.1 | 2.6.1-150200.24.1 |
lassoSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 4 CVEs |
before 2.6.1-150200.24.1 | 2.6.1-150200.24.1 |
lassoSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 4 CVEs |
before 2.6.1-150200.24.1 | 2.6.1-150200.24.1 |
lassoSUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 4 CVEs |
before 2.6.1-150200.24.1 | 2.6.1-150200.24.1 |
lassoSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 4 CVEs |
before 2.6.1-150200.24.1 | 2.6.1-150200.24.1 |
lassoSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 4 CVEs |
before 2.6.1-150200.24.1 | 2.6.1-150200.24.1 |
lassoSUSE:Manager Proxy LTS 4.3 From an advisory covering 4 CVEs |
before 2.6.1-150200.24.1 | 2.6.1-150200.24.1 |
lassoSUSE:Manager Server LTS 4.3 From an advisory covering 4 CVEs |
before 2.6.1-150200.24.1 | 2.6.1-150200.24.1 |
lassoSUSE:Enterprise Storage 7.1 From an advisory covering 4 CVEs |
before 2.6.1-150200.24.1 | 2.6.1-150200.24.1 |
lassoSUSE:Linux Enterprise Server 12 SP5-LTSS From an advisory covering 4 CVEs |
before 2.6.1-8.12.1 | 2.6.1-8.12.1 |
lassoSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 4 CVEs |
before 2.6.1-8.12.1 | 2.6.1-8.12.1 |
lassoUbuntu:16.04:LTS |
All versions, plus listed versions 2.4.1-1build12.5.0-12.5.0-22.5.0-32.5.0-3build12.5.0-3ubuntu2 |
None known |
lassoUbuntu:18.04:LTS |
All versions, plus listed versions 2.5.0-5build42.5.0-5build52.5.0-5ubuntu12.5.1-0ubuntu12.5.1-0ubuntu1.12.5.1-0ubuntu1.2 |
None known |
lassoUbuntu:20.04:LTS |
All versions, plus listed versions 2.6.0-2ubuntu12.6.0-2ubuntu22.6.0-7ubuntu12.6.0-7ubuntu1.12.6.0-7ubuntu1.2 |
None known |
lassoUbuntu:22.04:LTS |
before 2.7.0-2ubuntu0.1, plus listed versions 2.6.1-3build12.6.1-3build32.7.0-12.7.0-22.7.0-2build12.7.0-2build22.7.0-2build3 |
2.7.0-2ubuntu0.1 |
lassoUbuntu:24.04:LTS |
before 2.8.2-2ubuntu0.1, plus listed versions 2.8.1-12.8.1-1build12.8.1-22.8.2-12.8.2-1build12.8.2-2build12.8.2-2build2 |
2.8.2-2ubuntu0.1 |
lassoUbuntu:22.04:LTS From an advisory covering 4 CVEs |
before 2.7.0-2ubuntu0.1, plus listed versions 2.6.1-3build12.6.1-3build32.7.0-12.7.0-22.7.0-2build12.7.0-2build22.7.0-2build3 |
2.7.0-2ubuntu0.1 |
lassoUbuntu:24.04:LTS From an advisory covering 4 CVEs |
before 2.8.2-2ubuntu0.1, plus listed versions 2.8.1-12.8.1-1build12.8.1-22.8.2-12.8.2-1build12.8.2-2build12.8.2-2build2 |
2.8.2-2ubuntu0.1 |
lassoopenSUSE:Leap 16.0 From an advisory covering 3 CVEs |
before 2.8.2-160000.3.1 | 2.8.2-160000.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-46404 is a high vulnerability (CVSS 7.5) in Entr'ouvert Lasso, published November 5, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.64%, the 50th percentile. Fixed in lasso 2.9.0-1.
References
talosintelligence.com/vulnerability_reports/TALOS-2025-2194
nvd.nist.gov/vuln/detail/CVE-2025-46404
github.com/advisories/GHSA-2vvf-4m7q-pvpx
security-tracker.debian.org/tracker/CVE-2025-46404
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-2662
nvd.nist.gov/vuln/detail/CVE-2025-46705
Show 24 moreShow less
nvd.nist.gov/vuln/detail/CVE-2025-46784
nvd.nist.gov/vuln/detail/CVE-2025-47151
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-2663
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-2664
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-2665
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-2666
suse.com/support/update/announcement/2025/suse-su-202521140-1
bugzilla.suse.com/1253092
bugzilla.suse.com/1253093
bugzilla.suse.com/1253095
suse.com/security/cve/CVE-2025-46404
suse.com/security/cve/CVE-2025-46705
suse.com/security/cve/CVE-2025-47151
suse.com/support/update/announcement/2025/suse-su-20254068-1
suse.com/support/update/announcement/2025/suse-su-20254090-1
bugzilla.suse.com/1253094
suse.com/security/cve/CVE-2025-46784
suse.com/support/update/announcement/2025/suse-su-20254094-1
ubuntu.com/security/CVE-2025-46404
cve.org/CVERecord?id=CVE-2025-46404
ubuntu.com/security/notices/USN-7872-1
ubuntu.com/security/CVE-2025-46705
ubuntu.com/security/CVE-2025-46784
ubuntu.com/security/CVE-2025-47151