Denial of Service Vulnerability in Entr'ouvert Lasso Product
CVE-2025-46705

7.5HIGH

Key Information:

Vendor

Entr'ouvert

Status
Lasso
Vendor
CVE Published:
5 November 2025

What is CVE-2025-46705?

A vulnerability exists within the g_assert_not_reached function in Entr'ouvert Lasso versions 2.5.1 and 2.8.2, where a specially crafted SAML assertion response can exploit this flaw. When an attacker sends a malformed SAML response, it can lead to a denial of service condition, potentially causing the application to become unresponsive.

Affected Version(s)

Lasso 2.5.1

Lasso 2.8.2

References

https://talosintelligence.com/vulnerability_reports/TALOS...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Discovered by Keane O'Kelley of and another member of Cisco Advanced Security Initiative Group
JSON
.