What’s Vulnerable › Vulnerabilities

CVE-2025-25293: ruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responses

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-03-12 · updated 2026-06-17
• Weakness: CWE-400

Description

ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses. ruby-saml uses zlib to decompress SAML responses in case they're compressed. It is possible to bypass the message size check with a compressed assertion since the message size is checked before inflation and not after. This issue may lead to remote Denial of Service (DoS). Versions 1.12.4 and 1.18.0 fix the issue.

Affected products

• OmniAuth OmnitAuth-SAML: before 1.10.6; from 2.0.0 before 2.1.3; from 2.2.0 before 2.2.3 — fixed in 1.10.6, 2.1.3, 2.2.3
• SAML-Toolkits ruby-saml: before 1.12.4; from 1.13.0 before 1.18.0 — fixed in 1.12.4, 1.18.0
• Rubygems Ruby-Saml: before 1.12.4; from 1.13.0 before 1.18.0; 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.2.1, 0.2.2 (+80) — fixed in 1.12.4, 1.18.0

How to fix

Upgrade to a fixed version: OmniAuth OmnitAuth-SAML 1.10.6, 2.1.3, 2.2.3; SAML-Toolkits ruby-saml 1.12.4, 1.18.0; Rubygems Ruby-Saml 1.12.4, 1.18.0. Check the vendor advisory for mitigations.

References

• https://about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released
• https://github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-parser-differentials
• https://github.com/SAML-Toolkits/ruby-saml/commit/acac9e9cc0b9a507882c614f25d41f8b47be349a
• https://github.com/SAML-Toolkits/ruby-saml/commit/e2da4c6dae7dc01a4d9cd221395140a67e2b3eb1
• https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4
• https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.0
• https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-92rq-c8cf-prrq
• https://github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv
• https://securitylab.github.com/advisories/GHSL-2024-355_ruby-saml
• https://lists.debian.org/debian-lts-announce/2025/04/msg00011.html
• https://security.netapp.com/advisory/ntap-20250314-0008/

Get alerted when CVE-2025-25293 or the next vulnerability affects your stack