CVE-2024-52596: SimpleSAMLphp xml-common XXE vulnerability

Severity: high (CVSS 8.8 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-02 · updated 2026-06-17
Weakness: CWE-611

Description

SimpleSAMLphp xml-common is a common classes for handling XML-structures. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is fixed in 1.19.0.

Affected products

simplesamlphp xml-common: before 1.20.0 — fixed in 1.20.0

How to fix

Upgrade to a fixed version: simplesamlphp xml-common 1.20.0. Check the vendor advisory for mitigations.

References

https://github.com/simplesamlphp/xml-common/commit/fa4ade391c3194466acf5fbfd5d2ecdbf5e831f5
https://github.com/simplesamlphp/xml-common/security/advisories/GHSA-2x65-fpch-2fcm
https://lists.debian.org/debian-lts-announce/2024/12/msg00001.html

Get alerted when CVE-2024-52596 or the next vulnerability affects your stack