Remote Denial of Service in ruby-saml by SAML Toolkits
CVE-2025-25293

7.7HIGH

Key Information:

Vendor

Saml-toolkits

Status
Ruby-saml
Vendor
CVE Published:
12 March 2025

What is CVE-2025-25293?

The ruby-saml library, utilized for SAML single sign-on in Ruby applications, is vulnerable to a remote Denial of Service attack via compressed SAML assertions. Due to reliance on zlib for decompression, an attacker can exploit this flaw by sending specially crafted compressed responses that bypass message size checks before decompression. This can result in service disruption. Upgrades to versions 1.12.4 and 1.18.0 are necessary to mitigate this issue.

Affected Version(s)

ruby-saml < 1.12.4 < 1.12.4

ruby-saml >= 1.13.0, < 1.18.0 < 1.13.0, 1.18.0

References

https://github.com/SAML-Toolkits/ruby-saml/security/advis...
x_refsource_CONFIRM
https://github.com/omniauth/omniauth-saml/security/adviso...
x_refsource_MISC
https://github.com/SAML-Toolkits/ruby-saml/commit/acac9e9...
x_refsource_MISC

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-25293 : Remote Denial of Service in ruby-saml by SAML Toolkits