{"id":"CVE-2023-28119","aliases":["EUVD-2023-0885","GHSA-5mqj-xc49-246p","GO-2023-1664","UBUNTU-CVE-2023-28119"],"status":"published","title":"crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb","description":"The crewjam/saml go library contains a partial implementation of the SAML standard in golang. Prior to version 0.4.13, the package's use of `flate.NewReader` does not limit the size of the input. The user can pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process. This issue is patched in version 0.4.13.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00957,"percentile":0.61736,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2023-03-22T19:51:13Z","modified":"2026-10-28T02:30:48Z","fixes":[{"ecosystem":"Go","package":"github.com/crewjam/saml","fixed_in":["0.4.13"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/crewjam/saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.13"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/crewjam/saml","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.13"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/crewjam/saml","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.4.13"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-github-crewjam-saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.5+git20201228.07f15a6-2","0.4.6-1","0.4.6-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"golang-github-crewjam-saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.4.12-2"]}],"products":[{"vendor":"crewjam","product":"saml"},{"vendor":"saml_project","product":"saml"}],"references":[{"url":"https://github.com/crewjam/saml/security/advisories/GHSA-5mqj-xc49-246p","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://github.com/crewjam/saml/commit/8e9236867d176ad6338c870a84e2039aef8a5021","tags":["x_refsource_MISC","x_transferred","Patch","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-28119","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5mqj-xc49-246p"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28119.json","tags":["advisory"]},{"url":"https://github.com/crewjam/saml","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2023-28119","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-28119","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-28119","title":"crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb","description":"The crewjam/saml go library contains a partial implementation of the SAML standard in golang. Prior to version 0.4.13, the package's use of `flate.NewReader` does not limit the size of the input. The user can pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process. This issue is patched in version 0.4.13.\n","status":"published","published":"2023-03-22T19:51:13.21Z","modified":"2025-02-25T14:51:31.42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:35:32.752775Z"}],"euvd":[{"id":"EUVD-2023-0885","description":"The crewjam/saml go library contains a partial implementation of the SAML standard in golang. Prior to version 0.4.13, the package's use of `flate.NewReader` does not limit the size of the input. The user can pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process. This issue is patched in version 0.4.13.\n","status":"published","published":"2023-03-22T19:51:13Z","modified":"2025-02-25T14:51:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:53:24.646946Z"}],"ghsa":[{"id":"GHSA-5mqj-xc49-246p","title":"crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb","description":"Our use of flate.NewReader does not limit the size of the input. The user could pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process.\n","status":"published","published":"2023-03-22T21:23:25Z","modified":"2023-03-23T07:45:38Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:36:48.041653Z"}],"nvd":[{"id":"CVE-2023-28119","description":"The crewjam/saml go library contains a partial implementation of the SAML standard in golang. Prior to version 0.4.13, the package's use of `flate.NewReader` does not limit the size of the input. The user can pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process. This issue is patched in version 0.4.13.\n","status":"published","published":"2023-03-22T20:15:12.877Z","modified":"2026-06-17T05:46:54.803Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:07:50.908252Z"}],"osv":[{"id":"CVE-2023-28119","title":"crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb","description":"The crewjam/saml go library contains a partial implementation of the SAML standard in golang. Prior to version 0.4.13, the package's use of `flate.NewReader` does not limit the size of the input. The user can pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process. This issue is patched in version 0.4.13.\n","status":"published","published":"2023-03-22T19:51:13.21Z","modified":"2026-10-28T02:30:48.513837642Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:44:31.468318Z"},{"id":"GHSA-5mqj-xc49-246p","title":"crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb","description":"Our use of flate.NewReader does not limit the size of the input. The user could pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process.\n","status":"published","published":"2023-03-22T21:23:25Z","modified":"2026-08-07T08:12:04.985969571Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"UBUNTU-CVE-2023-28119","description":"The crewjam/saml go library contains a partial implementation of the SAML standard in golang. Prior to version 0.4.13, the package's use of `flate.NewReader` does not limit the size of the input. The user can pass more than 1 MB of data in the HTTP request to the processing functions, which will be decompressed server-side using the Deflate algorithm. Therefore, after repeating the same request multiple times, it is possible to achieve a reliable crash since the operating system kills the process. This issue is patched in version 0.4.13.","status":"published","published":"2023-03-22T20:15:00Z","modified":"2025-09-08T16:56:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:20.997471Z"},{"id":"GO-2023-1664","title":"Denial of service via deflate compression bomb in github.com/crewjam/saml","description":"Denial of service via deflate compression bomb in github.com/crewjam/saml","status":"published","published":"2023-08-23T14:38:10Z","modified":"2026-08-07T08:12:30.812086276Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}