Read the docs
TI-2023-11630 Aliases CVE-2023-26483GHSA-6gc3-crp7-25w5

gosaml2 vulnerable to Denial of Service via deflate decompression bomb

Priority LOW 32CWE-409Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

gosaml2 is a Pure Go implementation of SAML 2.0. SAML Service Providers using this library for SAML authentication support are likely susceptible to Denial of Service attacks. A bug in this library enables attackers to craft a `deflate`-compressed request which will consume significantly more memory during processing than the size of the original request. This may eventually lead to memory exhaustion and the process being killed. The maximum compression ratio achievable with `deflate` is 1032:1, so by limiting the size of bodies passed to gosaml2, limiting the rate and concurrency of calls, and ensuring that lots of memory is available to the process it _may_ be possible to help Go's garbage collector "keep up". Implementors are encouraged not to rely on this. This issue is fixed in version 0.9.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00964 61st percentileScored 2026-11-07
Fix Partial gosaml2 (russellhaering): 0.9.0github.com/russellhaering/gosaml2 (Go): 0.9.0Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
russellhaeringgosaml2before 0.9.00.9.0Patch availableCNA
—github.com/russellhaering/gosaml2 (Go)before 0.9.00.9.0Patch availableGHSA-6gc3-crp7-25w5
  • gosaml2 Vendorrussellhaering Affected before 0.9.0 Fixed in 0.9.0 Patch available CNA
  • github.com/russellhaering/gosaml2 (Go) Vendor— Affected before 0.9.0 Fixed in 0.9.0 Patch available GHSA-6gc3-crp7-25w5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gosaml2_project:gosaml2:*:*:*:*:*:*:*:*before 0.9.0VulnerableGosaml2 Project
  • cpe:2.3:a:gosaml2_project:gosaml2:*:*:*:*:*:*:*:* Versions before 0.9.0 Vulnerable ·Gosaml2 Project

Remediation

  • Fix · CNA gosaml2 (russellhaering) Fixed in 0.9.0
  • Fix · GHSA-6gc3-crp7-25w5 github.com/russellhaering/gosaml2 (Go) Fixed in 0.9.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Advanced Cluster Security 3AffectedNo fix yet
Not affected: 1 product
  • Red Hat Advanced Cluster Security 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-26483
  2. 2026-10-03 Alias added: GHSA-6gc3-crp7-25w5

References

Patch 1

Advisory 3

Other 2

  • TI-2020-06250 Denial of service (DoS) in github.com/russellhaering/gosaml2 CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences