{"id":"CVE-2025-54572","aliases":["DEBIAN-CVE-2025-54572","DLA-4288-1","EUVD-2025-23157","GHSA-rrqh-93c8-j966","UBUNTU-CVE-2025-54572"],"status":"published","title":"Ruby SAML DOS vulnerability with large SAML response","description":"The Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denial-of-service vulnerability exists in ruby-saml even with the message_max_bytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion. This is fixed in version 1.18.1.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00456,"percentile":0.39859,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2025-07-30T13:20:05Z","modified":"2026-10-28T02:30:39Z","fixes":[{"ecosystem":"RubyGems","package":"ruby-saml","fixed_in":["1.18.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:11","package":"ruby-saml","fixed_in":["1.11.0-1+deb11u3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"ruby-saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.13.0-1","1.13.0-1+deb12u1","1.15.0-1","1.17.0-1"]},{"source":"osv","ecosystem":"Debian:11","package":"ruby-saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.0-1+deb11u3"}]}],"versions":["1.11.0-1","1.11.0-1+deb11u1","1.11.0-1+deb11u2"]},{"source":"osv","ecosystem":"RubyGems","package":"ruby-saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.1"}]}],"versions":["0.0.5","0.0.6","0.0.7","0.0.8","0.2.1","0.2.2","0.2.3","0.3.0","0.3.1","0.3.2","0.3.3","0.3.4","0.4.0","0.4.1","0.4.2","0.4.3","0.4.4","0.4.5","0.4.6","0.4.7","0.5.0","0.5.1","0.5.2","0.5.3","0.6.0","0.7.0","0.7.1","0.7.2","0.7.3","0.8.0","0.8.1","0.8.10","0.8.11","0.8.12","0.8.13","0.8.14","0.8.15","0.8.16","0.8.17","0.8.18","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.8.9","0.9","0.9.1","0.9.2","0.9.3","0.9.4","1.0.0","1.1.0","1.1.1","1.1.2","1.10.0","1.10.1","1.10.2","1.11.0","1.12.0","1.12.1","1.12.2","1.12.3","1.12.4","1.13.0","1.14.0","1.15.0","1.16.0","1.17.0","1.18.0","1.2.0","1.3.0","1.3.1","1.4.0","1.4.1","1.4.2","1.4.3","1.5.0","1.6.0","1.6.1","1.6.2","1.7.0","1.7.1","1.7.2","1.8.0","1.9.0"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"ruby-saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.2-1","1.0.0-1","1.1.2-1ubuntu1","1.1.2-1ubuntu1+esm1","1.1.2-1ubuntu1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"ruby-saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.1-1","1.7.2-1","1.7.2-1ubuntu0.1~esm1","1.7.2-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"ruby-saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.2-1","1.11.0-1","1.11.0-1ubuntu0.1","1.11.0-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"ruby-saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.11.0-1","1.13.0-1","1.13.0-1ubuntu0.1","1.13.0-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"ruby-saml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15.0-1","1.15.0-1ubuntu0.24.04.1","1.15.0-1ubuntu0.24.04.1+esm1"]}],"products":[{"vendor":"saml-toolkits","product":"ruby-saml"}],"references":[{"url":"https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-rrqh-93c8-j966","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/SAML-Toolkits/ruby-saml/pull/770","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/SAML-Toolkits/ruby-saml/commit/38ef5dd1ce17514e202431f569c4f5633e6c2709","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.1","tags":["x_refsource_MISC","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00001.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-54572","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/CVE-2025-54572.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rrqh-93c8-j966"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54572.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-54572","tags":["advisory"]},{"url":"https://github.com/SAML-Toolkits/ruby-saml","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-54572","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-54572","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-54572","title":"Ruby SAML DOS vulnerability with large SAML response","description":"The Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denial-of-service vulnerability exists in ruby-saml even with the message_max_bytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion. This is fixed in version 1.18.1.","status":"published","published":"2025-07-30T14:05:43.82Z","modified":"2025-11-03T18:13:37.284Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:32:27.603809Z"}],"euvd":[{"id":"EUVD-2025-23157","description":"The Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denial-of-service vulnerability exists in ruby-saml even with the message_max_bytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion. This is fixed in version 1.18.1.","status":"published","published":"2025-07-30T14:05:43Z","modified":"2025-11-03T18:13:37Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:49:34.635725Z"}],"ghsa":[{"id":"GHSA-rrqh-93c8-j966","title":"Ruby SAML DOS vulnerability with large SAML response","description":"### Summary\nA denial-of-service vulnerability exists in ruby-saml even with the message_max_bytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion.\n\n### Details\n`ruby-saml` includes a `message_max_bytesize` setting intended to prevent DOS attacks and decompression bombs. However, this protection is ineffective in some cases due to the order of operations in the code:\n\nhttps://github.com/SAML-Toolkits/ruby-saml/blob/fbbedc978300deb9355a8e505849666974ef2e67/lib/onelogin/ruby-saml/saml_message.rb\n\n```ruby\n      def decode_raw_saml(saml, settings = nil)\n        return saml unless base64_encoded?(saml) # \u003c--- Issue here. Should be moved after next code block.\n\n        settings = OneLogin::RubySaml::Settings.new if settings.nil?\n        if saml.bytesize \u003e settings.message_max_bytesize\n          raise ValidationError.new(\"Encoded SAML Message exceeds \" + settings.message_max_bytesize.to_s + \" bytes, so was rejected\")\n        end\n\n        decoded = decode(saml)\n        ...\n      end\n```\n\nThe vulnerability is in the execution order. Prior to checking bytesize the `base64_encoded?` function performs regex matching on the entire input string:\n\n```ruby\n!!string.gsub(/[\\r\\n]|\\\\r|\\\\n|\\s/, \"\").match(BASE64_FORMAT)\n```\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nWhen successfully exploited, this vulnerability can lead to:\n\n- Excessive memory consumption\n- High CPU utilization\n- Application slowdown or unresponsiveness\n- Complete application crash in severe cases\n- Potential denial of service for legitimate users\n\nAll applications using `ruby-saml` with SAML configured and enabled are vulnerable.\n\n### Potential Solution\n\nReorder the validation steps to ensure max bytesize is checked first\n\n```ruby\ndef decode_raw_saml(saml, settings = nil)\n  settings = OneLogin::RubySaml::Settings.new if settings.nil?\n\n  if saml.bytesize \u003e settings.message_max_bytesize\n    raise ValidationError.new(\"Encoded SAML Message exceeds \" + settings.message_max_bytesize.to_s + \" bytes, so was rejected\")\n  end\n  \n  return saml unless base64_encoded?(saml)\n  decoded = decode(saml)\n  ...\nend\n```","status":"published","published":"2025-07-30T13:20:05Z","modified":"2025-11-03T21:35:23Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:39:05.278442Z"}],"nvd":[{"id":"CVE-2025-54572","description":"The Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denial-of-service vulnerability exists in ruby-saml even with the message_max_bytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion. This is fixed in version 1.18.1.","status":"published","published":"2025-07-30T14:15:29.433Z","modified":"2026-06-17T09:40:19.947Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:11:21.71471Z"}],"osv":[{"id":"CVE-2025-54572","title":"Ruby SAML DOS vulnerability with large SAML response","description":"The Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denial-of-service vulnerability exists in ruby-saml even with the message_max_bytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion. This is fixed in version 1.18.1.","status":"published","published":"2025-07-30T14:05:43.82Z","modified":"2026-10-28T02:30:39.506012527Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:44:50.863921Z"},{"id":"DEBIAN-CVE-2025-54572","description":"The Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denial-of-service vulnerability exists in ruby-saml even with the message_max_bytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion. This is fixed in version 1.18.1.","status":"published","published":"2025-07-30T14:15:29.433Z","modified":"2026-09-01T20:04:23.794376516Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"GHSA-rrqh-93c8-j966","title":"Ruby SAML DOS vulnerability with large SAML response","description":"### Summary\nA denial-of-service vulnerability exists in ruby-saml even with the message_max_bytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion.\n\n### Details\n`ruby-saml` includes a `message_max_bytesize` setting intended to prevent DOS attacks and decompression bombs. However, this protection is ineffective in some cases due to the order of operations in the code:\n\nhttps://github.com/SAML-Toolkits/ruby-saml/blob/fbbedc978300deb9355a8e505849666974ef2e67/lib/onelogin/ruby-saml/saml_message.rb\n\n```ruby\n      def decode_raw_saml(saml, settings = nil)\n        return saml unless base64_encoded?(saml) # \u003c--- Issue here. Should be moved after next code block.\n\n        settings = OneLogin::RubySaml::Settings.new if settings.nil?\n        if saml.bytesize \u003e settings.message_max_bytesize\n          raise ValidationError.new(\"Encoded SAML Message exceeds \" + settings.message_max_bytesize.to_s + \" bytes, so was rejected\")\n        end\n\n        decoded = decode(saml)\n        ...\n      end\n```\n\nThe vulnerability is in the execution order. Prior to checking bytesize the `base64_encoded?` function performs regex matching on the entire input string:\n\n```ruby\n!!string.gsub(/[\\r\\n]|\\\\r|\\\\n|\\s/, \"\").match(BASE64_FORMAT)\n```\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nWhen successfully exploited, this vulnerability can lead to:\n\n- Excessive memory consumption\n- High CPU utilization\n- Application slowdown or unresponsiveness\n- Complete application crash in severe cases\n- Potential denial of service for legitimate users\n\nAll applications using `ruby-saml` with SAML configured and enabled are vulnerable.\n\n### Potential Solution\n\nReorder the validation steps to ensure max bytesize is checked first\n\n```ruby\ndef decode_raw_saml(saml, settings = nil)\n  settings = OneLogin::RubySaml::Settings.new if settings.nil?\n\n  if saml.bytesize \u003e settings.message_max_bytesize\n    raise ValidationError.new(\"Encoded SAML Message exceeds \" + settings.message_max_bytesize.to_s + \" bytes, so was rejected\")\n  end\n  \n  return saml unless base64_encoded?(saml)\n  decoded = decode(saml)\n  ...\nend\n```","status":"published","published":"2025-07-30T13:20:05Z","modified":"2026-09-10T03:50:26.252859842Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"UBUNTU-CVE-2025-54572","description":"The Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denial-of-service vulnerability exists in ruby-saml even with the message_max_bytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion. This is fixed in version 1.18.1.","status":"published","published":"2025-07-30T14:15:00Z","modified":"2026-01-20T19:04:33.916429Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"DLA-4288-1","title":"ruby-saml - security update","status":"published","published":"2025-09-01T00:00:00Z","modified":"2026-03-09T02:10:41.499505Z","updated_at":"2026-11-02T15:46:12.7027Z"}]}}