CVE-2026-49289: SimpleSAMLphp has Possible DoS via XPath Transform

July 2, 2026 (updated August 5, 2026)

This library turned out to be vulnerable to Denial-of-Service attacks using XPath transforms. A mitigation has been put in place to restrict the number of transforms and to restrict transforms to only the transform-algorithms mentioned in the SAML 2.0 Core Specifications (and specifically refuse XPath transforms).

References

github.com/advisories/GHSA-5cjr-mxj5-wmrx
github.com/simplesamlphp/saml2/security/advisories/GHSA-5cjr-mxj5-wmrx
nvd.nist.gov/vuln/detail/CVE-2026-49289

Code Behaviors & Features

Detect and mitigate CVE-2026-49289 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →