CVE-2025-25293highCWE-400

CVE-2025-25293: high-severity vulnerability in SAML-Toolkits ruby-saml

ruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responses

Published · Updated

Follow this CVE+ Monitor ruby-saml+ Monitor ruby-saml

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.7epss 1.5%
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses. ruby-saml uses zlib to decompress SAML responses in case they're compressed. It is possible to bypass the message size check with a compressed assertion since the message size is checked before inflation and not after. This issue may lead to remote Denial of Service (DoS). Versions 1.12.4 and 1.18.0 fix the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P
Affected products
SAML-Toolkits · ruby-saml
Related CVEs — SAML-Toolkits ruby-saml

In the same product, most dangerous first.

CVE-2025-25292CRITICALRuby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)EPSS 65.1%CVE-2025-25291CRITICALruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)EPSS 21.0%CVE-2024-45409CRITICALThe Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selectorEPSS 12.5%CVE-2025-54572MEDIUMRuby SAML DOS vulnerability with large SAML responseEPSS 0.5%CVE-2025-66567CRITICALruby-saml has a SAML authentication bypass due to namespace handling (parser differential)EPSS 0.4%CVE-2025-66568CRITICALruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validationEPSS 0.3%