CVE-2025-54572 - Ruby SAML DOS vulnerability with large SAML response

Back Back to CVE browser

MEDIUM

Ruby SAML DOS vulnerability with large SAML response

Published Jul 30, 2025

6.9

MEDIUM

CVSS 4.0

EPSS 0.40%

Description

The Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denial-of-service vulnerability exists in ruby-saml even with the message_max_bytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion. This is fixed in version 1.18.1.

Affected products

Vendor SAML-Toolkits Product Ruby-Saml Default
n/a
- Version
  < 1.18.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAML-Toolkits

Ruby-Saml

n/a

Version	Status	Constraints
< 1.18.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-400

Uncontrolled Resource Consumption

CWE-770

Allocation of Resources Without Limits

References (9)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-23157
Advisory
https://github.com/SAML-Toolkits/ruby-saml/commit/38ef5dd1ce17514e202431f569c4f5633e6c2709
x_refsource_MISC
https://github.com/SAML-Toolkits/ruby-saml/pull/770
x_refsource_MISC
https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.1
x_refsource_MISC
https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-rrqh-93c8-j966
x_refsource_CONFIRM
https://github.com/advisories/GHSA-rrqh-93c8-j966
Advisory
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/CVE-2025-54572.yml
https://lists.debian.org/debian-lts-announce/2025/09/msg00001.html
https://nvd.nist.gov/vuln/detail/CVE-2025-54572

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-23157		Advisory
https://github.com/SAML-Toolkits/ruby-saml/commit/38ef5dd1ce17514e202431f569c4f5633e6c2709		x_refsource_MISC
https://github.com/SAML-Toolkits/ruby-saml/pull/770		x_refsource_MISC
https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.1		x_refsource_MISC
https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-rrqh-93c8-j966		x_refsource_CONFIRM
https://github.com/advisories/GHSA-rrqh-93c8-j966		Advisory
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/CVE-2025-54572.yml
https://lists.debian.org/debian-lts-announce/2025/09/msg00001.html
https://nvd.nist.gov/vuln/detail/CVE-2025-54572