Denial of Service Vulnerability in Entr'ouvert Lasso Product
CVE-2025-46705

9.6CRITICAL

Key Information:

Vendor

Entr'ouvert

Status
Lasso
Vendor
CVE Published:
5 November 2025

What is CVE-2025-46705?

A vulnerability exists within the g_assert_not_reached function in Entr'ouvert Lasso versions 2.5.1 and 2.8.2, where a specially crafted SAML assertion response can exploit this flaw. When an attacker sends a malformed SAML response, it can lead to a denial of service condition, potentially causing the application to become unresponsive.

Affected Version(s)

Lasso 2.5.1

Lasso 2.8.2

References

https://talosintelligence.com/vulnerability_reports/TALOS...

CVSS V3.1

Score:
9.6
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Discovered by Keane O'Kelley of and another member of Cisco Advanced Security Initiative Group
JSON
.
CVE-2025-46705 : Denial of Service Vulnerability in Entr'ouvert Lasso Product