ruby-saml 1.17.0
Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)
critical severity CVE-2025-25292~> 1.12.4, >= 1.18.0
Summary
An authentication bypass vulnerability was found in ruby-saml due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack.
Impact
This issue may lead to authentication bypass.
Ruby SAML allows a SAML authentication bypass due to DOCTYPE handling (parser differential)
critical severity CVE-2025-25291~> 1.12.4, >= 1.18.0
Summary
An authentication bypass vulnerability was found in ruby-saml due to a parser differential. ReXML and Nokogiri parse XML differently, the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack.
Impact
This issue may lead to authentication bypass.
Ruby SAML allows remote Denial of Service (DoS) with compressed SAML responses
high severity CVE-2025-25293~> 1.12.4, >= 1.18.0
Summary
ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses.
Ruby-saml uses zlib to decompress SAML responses in case they're compressed. It is possible to bypass the message size check with a compressed assertion since the message size is checked before inflation and not after.
Impact
This issue may lead to remote Denial of Service (DoS).
No officially reported memory leakage issues detected.
This gem version does not have any officially reported memory leaked issues.
No license issues detected.
This gem version has a license in the gemspec.
This gem version is available.
This gem version has not been yanked and is still available for usage.