What’s Vulnerable › Vulnerabilities

CVE-2018-6519

• Severity: high (CVSS 7.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-02-02 · updated 2026-06-17
• Weakness: CWE-74

Description

The SAML2 library before 1.10.4, 2.x before 2.3.5, and 3.x before 3.1.1 in SimpleSAMLphp has a Regular Expression Denial of Service vulnerability for fraction-of-seconds data in a timestamp.

Affected products

• Debian Linux: 8.0, 9.0
• simplesamlphp saml2: from 1.0.0 before 1.10.4; from 2.0.0 before 2.3.5; from 3.0.0 before 3.1.1 — fixed in 1.10.4, 2.3.5, 3.1.1

How to fix

Upgrade to a fixed version: simplesamlphp saml2 1.10.4, 2.3.5, 3.1.1. Check the vendor advisory for mitigations.

References

• https://simplesamlphp.org/security/201801-01
• https://www.debian.org/security/2018/dsa-4127
• https://simplesamlphp.org/security/201801-01
• https://www.debian.org/security/2018/dsa-4127

Get alerted when CVE-2018-6519 or the next vulnerability affects your stack