CVE-2025-54572mediumCWE-400CWE-770

CVE-2025-54572: medium-severity vulnerability in SAML-Toolkits ruby-saml

Ruby SAML DOS vulnerability with large SAML response

Published · Updated

Follow this CVE+ Monitor ruby-saml+ Monitor ruby-saml

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.5%
The Ruby SAML library is for implementing the client side of a SAML authorization. In versions 1.18.0 and below, a denial-of-service vulnerability exists in ruby-saml even with the message_max_bytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion. This is fixed in version 1.18.1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
SAML-Toolkits · ruby-saml
Related CVEs — SAML-Toolkits ruby-saml

In the same product, most dangerous first.

CVE-2025-25292CRITICALRuby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)EPSS 65.1%CVE-2025-25291CRITICALruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)EPSS 21.0%CVE-2024-45409CRITICALThe Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selectorEPSS 12.5%CVE-2025-25293HIGHruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responsesEPSS 1.5%CVE-2025-66567CRITICALruby-saml has a SAML authentication bypass due to namespace handling (parser differential)EPSS 0.4%CVE-2025-66568CRITICALruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validationEPSS 0.3%