Resource exhaustion in Omniauth Saml
CVE-2025-25293
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses. ruby-saml uses zlib to decompress SAML responses in case they're compressed. It is possible to bypass the message size check with a compressed assertion since the message size is checked before inflation and not after. This issue may lead to remote Denial of Service (DoS). Versions 1.12.4 and 1.18.0 fix the issue.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.015 (74.7th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 75th percentile — 74.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: +0.000
Affected products
- Omniauth Saml
- Onelogin Ruby-Saml
- Saml-Toolkits Ruby-Saml — versions < 1.12.4, >= 1.13.0, < 1.18.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-92rq-c8cf-prrq (Vendor Advisory)
- github.com/omniauth/omniauth-saml/security/advisories/GHSA-hw46-3hmr-x9xv (Vendor Advisory)
- github.com/SAML-Toolkits/ruby-saml/commit/acac9e9cc0b9a507882c614f25d41f8b47be3… (Patch)
- github.com/SAML-Toolkits/ruby-saml/commit/e2da4c6dae7dc01a4d9cd221395140a67e2b3… (Patch)
- about.gitlab.com/releases/2025/03/12/patch-release-gitlab-17-9-2-released (Patch)
- github.blog/security/sign-in-as-anyone-bypassing-saml-sso-authentication-with-p… (Exploit, Third Party Advisory)
- github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.12.4 (Release Notes)
- github.com/SAML-Toolkits/ruby-saml/releases/tag/v1.18.0 (Release Notes)
- securitylab.github.com/advisories/GHSL-2024-355_ruby-saml (Exploit, Third Party Advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2025-25293?
- CVE-2025-25293 is a high-severity vulnerability in Omniauth Saml, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2025-03-12.
- How severe is CVE-2025-25293?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2025-25293 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.