Identity CVE · SAML
CVE-2025-25293ruby-saml denial of service via compressed SAML messages
high
Product: ruby-samlVendor: SAML-ToolkitsCWE-400Disclosed: 2025-03-12Status: PatchedProtocol deep diveNVD ↗
What broke
ruby-saml accepted compressed SAML messages without a tight bound on the decompressed size. A crafted payload can expand into a denial-of-service against the process that verifies SSO responses. Patched in the same March 2025 release as CVE-2025-25291 and CVE-2025-25292.
Why it matters
This one does not log anyone in as admin. It takes the SSO endpoint offline, which for a workforce IdP is still an identity incident: password resets, break-glass, and help-desk social engineering spike the moment login is down. Attackers who cannot wrap a signature will happily knock the verifier over instead.
What to do
- Upgrade ruby-saml with the wrapping fixes. Do not cherry-pick only the critical CVEs.
- Cap compressed SAML (and HTTP-Redirect binding) payloads at the reverse proxy, not only in the library.
- Watch for a sudden rise in 5xx on ACS endpoints after a failed login burst.
Sources
Related identity CVEs
Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.