CVE-2025-54572: Ruby SAML DOS vulnerability with large SAML response
(updated )
A denial-of-service vulnerability exists in ruby-saml even with the message_max_bytesize setting configured. The vulnerability occurs because the SAML response is validated for Base64 format prior to checking the message size, leading to potential resource exhaustion.
References
- github.com/SAML-Toolkits/ruby-saml
- github.com/SAML-Toolkits/ruby-saml/commit/38ef5dd1ce17514e202431f569c4f5633e6c2709
- github.com/SAML-Toolkits/ruby-saml/pull/770
- github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.1
- github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-rrqh-93c8-j966
- github.com/advisories/GHSA-rrqh-93c8-j966
- github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-saml/CVE-2025-54572.yml
- nvd.nist.gov/vuln/detail/CVE-2025-54572
Code Behaviors & Features
Detect and mitigate CVE-2025-54572 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →