CVE-2025-25293
High
Description
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses. ruby-saml uses zlib to decompress SAML responses in case they're compressed. It is possible to bypass the message size check with a compressed assertion since the message size is checked before inflation and not after. This issue may lead to remote Denial of Service (DoS). Versions 1.12.4 and 1.18.0 fix the issue.
SeverityHigh
CVSS7.5
Exploit probability—
ProductOnelogin Ruby-saml
PublishedMar 12, 2025
First seenMar 12, 2025
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- onelogin ruby-saml1.12.4, 1.18.0 or later
- omniauth omniauth_saml1.10.6, 2.1.3, 2.2.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| onelogin ruby-saml | v < 1.12.4, 1.13.0 ≤ v < 1.18.0 | 1.12.4, 1.18.0 |
| omniauth omniauth_saml | v < 1.10.6, 2.0.0 ≤ v < 2.1.3, 2.2.0 ≤ v < 2.2.3 | 1.10.6, 2.1.3, 2.2.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.