ruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responses
Priority MEDIUM 43CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.
Summary
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses. ruby-saml uses zlib to decompress SAML responses in case they're compressed. It is possible to bypass the message size check with a compressed assertion since the message size is checked before inflation and not after. This issue may lead to remote Denial of Service (DoS). Versions 1.12.4 and 1.18.0 fix the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01528 74th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed ruby-saml (SAML-Toolkits): 1.12.4, 1.18.0ruby-saml (RubyGems): 1.12.4, 1.18.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| SAML-Toolkits | ruby-saml | before 1.12.4; 1.13.0 to before 1.18.0 | 1.12.4, 1.18.0 | Patch available | CNA |
| — | ruby-saml (RubyGems) | before 1.12.4 | 1.12.4 | Patch available | GHSA-92rq-c8cf-prrq |
| — | ruby-saml (RubyGems) | 1.13.0 to before 1.18.0 | 1.18.0 | Patch available | GHSA-92rq-c8cf-prrq |
- ruby-saml VendorSAML-Toolkits Affected before 1.12.4; 1.13.0 to before 1.18.0 Fixed in 1.12.4, 1.18.0 Patch available CNA
- ruby-saml (RubyGems) Vendor— Affected before 1.12.4 Fixed in 1.12.4 Patch available GHSA-92rq-c8cf-prrq
- ruby-saml (RubyGems) Vendor— Affected 1.13.0 to before 1.18.0 Fixed in 1.18.0 Patch available GHSA-92rq-c8cf-prrq
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:omniauth:omniauth_saml:*:*:*:*:*:ruby:*:* | before 1.10.6; 2.0.0 to before 2.1.3; 2.2.0 to before 2.2.3 | Vulnerable | OmniAuth |
| cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:* | before 1.12.4; 1.13.0 to before 1.18.0 | Vulnerable | SAML-Toolkits |
- cpe:2.3:a:omniauth:omniauth_saml:*:*:*:*:*:ruby:*:* Versions before 1.10.6; 2.0.0 to before 2.1.3; 2.2.0 to before 2.2.3 Vulnerable ·OmniAuth
- cpe:2.3:a:onelogin:ruby-saml:*:*:*:*:*:*:*:* Versions before 1.12.4; 1.13.0 to before 1.18.0 Vulnerable ·SAML-Toolkits
Remediation
- Fix · CNA ruby-saml (SAML-Toolkits) Fixed in 1.12.4, 1.18.0
- Fix · GHSA-92rq-c8cf-prrq ruby-saml (RubyGems) Fixed in 1.12.4 Advisory →
- Fix · GHSA-92rq-c8cf-prrq ruby-saml (RubyGems) Fixed in 1.18.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-25293
- 2026-10-03 Alias added: GHSA-92rq-c8cf-prrq
References
Exploit 2
Patch 3
Advisory 4
Other 6
- https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4
- https://github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.0
- https://github.com/SAML-Toolkits/ruby-saml
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/CVE-2025-25293.yml
- https://lists.debian.org/debian-lts-announce/2025/04/msg00011.html
- https://security.netapp.com/advisory/ntap-20250314-0008
More SAML-Toolkits Ruby-saml vulnerabilities
- TI-2025-18946 Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential) CVSS 4.0CRITICAL 9.3
- TI-2024-30458 The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector CVSS 3.1CRITICAL 10.0
- TI-2025-18945 ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential) CVSS 4.0CRITICAL 9.3
- TI-2015-08083 xml_security.rb in the ruby-saml gem before 1.0.0 for Ruby allows XPath injection and… CVSS 3.1CRITICAL 9.8
- TI-2025-40979 ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validation CVSS 4.0CRITICAL 9.3
- TI-2025-40978 ruby-saml has a SAML authentication bypass due to namespace handling (parser differential) CVSS 4.0CRITICAL 9.3
Sources
- CVE-2025-25293 · CVE Program
- CVE-2025-25293 · NVD
- FIRST EPSS
- GHSA-92rq-c8cf-prrq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences