Resource exhaustion in Omniauth Saml
CVE-2025-25293
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses. ruby-saml uses zlib to decompress SAML responses in case they're compressed. It is possible to bypass the message size check with a compressed assertion since the message size is checked before inflation and not after. This issue may lead to remote Denial of Service (DoS). Versions 1.12.4 and 1.18.0 fix the issue.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.015 (72.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Omniauth Omniauth_saml
- Onelogin Ruby-saml
- Saml-toolkits Ruby-saml — versions < 1.12.4, >= 1.13.0, < 1.18.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (x_refsource_MISC, Vendor Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Exploit, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Release Notes)
- security-advisories@github.com (x_refsource_MISC, Release Notes)
- security-advisories@github.com (Exploit, Third Party Advisory, x_refsource_MISC)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2025-25293?
- CVE-2025-25293 is a high-severity vulnerability in Omniauth Saml, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2025-03-12.
- How severe is CVE-2025-25293?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2025-25293 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.